Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 20:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file.exe
  • Size 220KB
  • Sample221002-za94cabaer
  • SHA256 824ac2e9253a1ef23fa9ee1d1fecee9535ae58101d246071ea62c38bec38ee23
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
nymaimtrojan

Malware Config

Extracted

Family

  • nymaim

C2

  • 208.67.104.97

  • 85.31.46.167

Signatures

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim
  • Program crash 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2312
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 456
      2⤵
      • Program crash
      PID:3728
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 768
      2⤵
      • Program crash
      PID:1132
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 808
      2⤵
      • Program crash
      PID:2608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 784
      2⤵
      • Program crash
      PID:2036
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 860
      2⤵
      • Program crash
      PID:2604
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 964
      2⤵
      • Program crash
      PID:4328
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 1012
      2⤵
      • Program crash
      PID:3316
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 880
      2⤵
      • Program crash
      PID:2520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 1028
      2⤵
      • Program crash
      PID:1740
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 1016
      2⤵
      • Program crash
      PID:1748
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2312 -ip 2312
    1⤵
      PID:3584
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2312 -ip 2312
      1⤵
        PID:4512
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2312 -ip 2312
        1⤵
          PID:3712
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2312 -ip 2312
          1⤵
            PID:5004
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2312 -ip 2312
            1⤵
              PID:1136
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2312 -ip 2312
              1⤵
                PID:224
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2312 -ip 2312
                1⤵
                  PID:3424
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2312 -ip 2312
                  1⤵
                    PID:4556
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2312 -ip 2312
                    1⤵
                      PID:4348
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2312 -ip 2312
                      1⤵
                        PID:3396

                      Network

                            MITRE ATT&CK Matrix

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            memory/2312-132-0x000000000079D000-0x00000000007C3000-memory.dmp
                            Download

                            memory/2312-133-0x0000000002190000-0x00000000021CF000-memory.dmp
                            Download

                            memory/2312-134-0x0000000000400000-0x0000000000594000-memory.dmp
                            Download

                            memory/2312-135-0x000000000079D000-0x00000000007C3000-memory.dmp
                            Download

                            memory/2312-136-0x0000000002190000-0x00000000021CF000-memory.dmp
                            Download

                            memory/2312-137-0x0000000000400000-0x0000000000594000-memory.dmp
                            Download