Analysis

  • max time kernel
    187s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2022, 18:20

General

  • Target

    file.exe

  • Size

    353KB

  • MD5

    b90bf592eb12ad336d85227381f6cd97

  • SHA1

    3e89a8b2cd8a7c1168b698027570dbaf4324cd36

  • SHA256

    4098ed30f5e2a1d453182391fcef81703351574f6c286ac4308bf0be675de907

  • SHA512

    af580dbf51df295bb5078126c062cc6dc4e8027fccc7cbb7b61c5df17a5c15c1321d43be4136dd43f75a2ad7d256cd46b7893b4af9171875c4e999921b7a5772

  • SSDEEP

    6144:B4J7ELi+hv99zL+bp1Cf0pgseVPlloeYbr/uzbgwuxc1wVf:2Cm+hv99XGw+gs8P4jHunnqc

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

208.67.104.97

85.31.46.167

Signatures

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 460
      2⤵
      • Program crash
      PID:2608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 764
      2⤵
      • Program crash
      PID:1068
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 804
      2⤵
      • Program crash
      PID:2312
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 804
      2⤵
      • Program crash
      PID:1488
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 800
      2⤵
      • Program crash
      PID:5096
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 840
      2⤵
      • Program crash
      PID:1684
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 996
      2⤵
      • Program crash
      PID:4476
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 1048
      2⤵
      • Program crash
      PID:3868
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 1380
      2⤵
      • Program crash
      PID:4296
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\IRbheKW2W\Cleaner.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\Users\Admin\AppData\Local\Temp\IRbheKW2W\Cleaner.exe
        "C:\Users\Admin\AppData\Local\Temp\IRbheKW2W\Cleaner.exe"
        3⤵
        • Executes dropped EXE
        PID:4076
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 4076 -s 972
          4⤵
          • Program crash
          PID:748
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 1384
      2⤵
      • Program crash
      PID:3232
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1060 -ip 1060
    1⤵
      PID:1452
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1060 -ip 1060
      1⤵
        PID:4500
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1060 -ip 1060
        1⤵
          PID:1064
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1060 -ip 1060
          1⤵
            PID:2176
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1060 -ip 1060
            1⤵
              PID:220
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1060 -ip 1060
              1⤵
                PID:2088
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1060 -ip 1060
                1⤵
                  PID:2680
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1060 -ip 1060
                  1⤵
                    PID:4424
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1060 -ip 1060
                    1⤵
                      PID:2132
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 572 -p 4076 -ip 4076
                      1⤵
                        PID:1508
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1060 -ip 1060
                        1⤵
                          PID:4988

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\IRbheKW2W\Cleaner.exe

                          Filesize

                          3.8MB

                          MD5

                          04514bd4962f7d60679434e0ebe49184

                          SHA1

                          1493a5447eb8156a7d7aecff60ee8bfba2209526

                          SHA256

                          c394b068aa87264419f60838a8812b750e67cf93f2494c62b9078c3708072568

                          SHA512

                          a71c7ed5dfdda22f095dc99b16e8342a42e3361be16e0241dbf8983dd0d5f6e90eb0299aac1815cf78ad3a9f15fa89b42b720b7f818ee5f502300f102ef4c93e

                        • C:\Users\Admin\AppData\Local\Temp\IRbheKW2W\Cleaner.exe

                          Filesize

                          3.8MB

                          MD5

                          04514bd4962f7d60679434e0ebe49184

                          SHA1

                          1493a5447eb8156a7d7aecff60ee8bfba2209526

                          SHA256

                          c394b068aa87264419f60838a8812b750e67cf93f2494c62b9078c3708072568

                          SHA512

                          a71c7ed5dfdda22f095dc99b16e8342a42e3361be16e0241dbf8983dd0d5f6e90eb0299aac1815cf78ad3a9f15fa89b42b720b7f818ee5f502300f102ef4c93e

                        • memory/1060-133-0x00000000005D0000-0x000000000060F000-memory.dmp

                          Filesize

                          252KB

                        • memory/1060-134-0x0000000000400000-0x000000000045E000-memory.dmp

                          Filesize

                          376KB

                        • memory/1060-135-0x00000000004BC000-0x00000000004E2000-memory.dmp

                          Filesize

                          152KB

                        • memory/1060-136-0x0000000000400000-0x000000000045E000-memory.dmp

                          Filesize

                          376KB

                        • memory/1060-132-0x00000000004BC000-0x00000000004E2000-memory.dmp

                          Filesize

                          152KB

                        • memory/4076-141-0x000001A560A90000-0x000001A560BE6000-memory.dmp

                          Filesize

                          1.3MB

                        • memory/4076-142-0x00007FFE80B20000-0x00007FFE815E1000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/4076-143-0x00007FFE80B20000-0x00007FFE815E1000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/4076-144-0x00007FFE80B20000-0x00007FFE815E1000-memory.dmp

                          Filesize

                          10.8MB