nymaim | 999022fa6acd7e8924a131f60172fb53812ecee298252abbf7cd9a7fa375f129

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 234KB
Sample221001-yzd7jadgg2
SHA256 999022fa6acd7e8924a131f60172fb53812ecee298252abbf7cd9a7fa375f129
MD5 6f3d4e9d973923bfe1e45d8a79fd5f37
SHA1 ae0fe4046e9d5ca76fe332677e1e9143cbe3f26c
SHA512 15d6c16b6230201d9882ef1e3efa9a83f81c30058651adbabdb87ffa8bdb59ee7ab6100e75133cf522c6becb1e9c3f36caeeb32be1e931cf9dac7c6105b15b9d
SSDEEP 3072:JDTrUSGRCi1/a3ICy9HRopYP3PY8VmRHZvbGy4RI6BqOPWIQtmC/g:dUp1/a3ICy9HXPPk5TGFIdOOItC/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim trojan

Malware Config

Extracted

Family

nymaim

208.67.104.97
85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1216	Cleaner.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 13 IoCs

pid	pid_target	Process	procid_target
4912	4676	WerFault.exe	81
3064	4676	WerFault.exe	81
3472	4676	WerFault.exe	81
1092	4676	WerFault.exe	81
3396	4676	WerFault.exe	81
4924	4676	WerFault.exe	81
1852	4676	WerFault.exe	81
220	4676	WerFault.exe	81
1648	4676	WerFault.exe	81
1536	1216	WerFault.exe	111
2924	4676	WerFault.exe	81
1112	4676	WerFault.exe	81
808	4676	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4676	file.exe
4676	file.exe
4676	file.exe
4676	file.exe
4676	file.exe
4676	file.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4676	file.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 2232	4676	file.exe	107
PID 4676 wrote to memory of 2232	4676	file.exe	107
PID 4676 wrote to memory of 2232	4676	file.exe	107
PID 2232 wrote to memory of 1216	2232	cmd.exe	111
PID 2232 wrote to memory of 1216	2232	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 460
  2⤵
  - Program crash
  PID:4912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 776
  2⤵
  - Program crash
  PID:3064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 808
  2⤵
  - Program crash
  PID:3472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 808
  2⤵
  - Program crash
  PID:1092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 828
  2⤵
  - Program crash
  PID:3396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 928
  2⤵
  - Program crash
  PID:4924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 936
  2⤵
  - Program crash
  PID:1852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1084
  2⤵
  - Program crash
  PID:220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1300
  2⤵
  - Program crash
  PID:1648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\aWXNjpl8ZLjDocvuIC\Cleaner.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Users\Admin\AppData\Local\Temp\aWXNjpl8ZLjDocvuIC\Cleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\aWXNjpl8ZLjDocvuIC\Cleaner.exe"
    3⤵
    - Executes dropped EXE
    PID:1216
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1216 -s 972
      4⤵
      Program crash
      PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1384
  2⤵
  - Program crash
  PID:2924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1004
  2⤵
  - Program crash
  PID:1112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1792
  2⤵
  - Program crash
  PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4676 -ip 4676
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4676 -ip 4676
1⤵
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4676 -ip 4676
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4676 -ip 4676
1⤵
PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4676 -ip 4676
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4676 -ip 4676
1⤵
PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4676 -ip 4676
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4676 -ip 4676
1⤵
PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4676 -ip 4676
1⤵
PID:1548

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 576 -p 1216 -ip 1216
1⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4676 -ip 4676
1⤵
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4676 -ip 4676
1⤵
PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4676 -ip 4676
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\aWXNjpl8ZLjDocvuIC\Cleaner.exe
Size 4.0MB
SHA256 f349739486dcb45f7cd39440784224c66a5d2c4bd2a47c48606e2f481a0fabe7
MD5 a1a19faf0af29841daeeaad999d899bd
SHA1 f67b9afdab167d5bcc544358b0e7fd2858784508
SHA512 a66ec486262e797bafd4fa032a719e499217993479fa78938e43db13289fe6fefc0ef3c3359e3cacb6223134396852be7cc9122c46ae74db3e9842d7f4fe65a8
SSDEEP 49152:M/PD/DL/D9CuZrr2h60qPGPD/jL/jdCuZrL2BaUKPmPD/jL/jdCuZrL2BaUKPs:M3D///UUrP6D/f/UULPaD/f/UULPs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\aWXNjpl8ZLjDocvuIC\Cleaner.exe
Size 4.0MB
SHA256 f349739486dcb45f7cd39440784224c66a5d2c4bd2a47c48606e2f481a0fabe7
MD5 a1a19faf0af29841daeeaad999d899bd
SHA1 f67b9afdab167d5bcc544358b0e7fd2858784508
SHA512 a66ec486262e797bafd4fa032a719e499217993479fa78938e43db13289fe6fefc0ef3c3359e3cacb6223134396852be7cc9122c46ae74db3e9842d7f4fe65a8
SSDEEP 49152:M/PD/DL/D9CuZrr2h60qPGPD/jL/jdCuZrL2BaUKPmPD/jL/jdCuZrL2BaUKPs:M3D///UUrP6D/f/UULPaD/f/UULPs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1216-141-0x00000279F5530000-0x00000279F5688000-memory.dmp

Download

memory/1216-142-0x00007FFD888E0000-0x00007FFD893A1000-memory.dmp

Download

memory/1216-143-0x00007FFD888E0000-0x00007FFD893A1000-memory.dmp

Download

memory/4676-135-0x000000000075D000-0x0000000000783000-memory.dmp

Download

memory/4676-136-0x0000000000400000-0x0000000000597000-memory.dmp

Download

memory/4676-134-0x0000000000400000-0x0000000000597000-memory.dmp

Download

memory/4676-133-0x00000000021E0000-0x000000000221F000-memory.dmp

Download

memory/4676-132-0x000000000075D000-0x0000000000783000-memory.dmp

Download

memory/4676-144-0x0000000010000000-0x000000001001B000-memory.dmp

Download