nymaim | 00b80f0290e2650a1ff6ca5ce623072ecdb475e9e268499d3d064757739b6ae4

Analysis

max time kernel
140s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.4MB
Sample221014-pff3caddf2
SHA256 00b80f0290e2650a1ff6ca5ce623072ecdb475e9e268499d3d064757739b6ae4
MD5 72b164726d59f3804452eea457d5aba2
SHA1 5c2deffc54f4c9a63ebd450ccb018317dcc032e2
SHA512 b32645b1cdbd3e488ec874c0cd4bdce6a5c362ef2e0cd20783629c22639873a2cb85090606ad700353683ed3d5cfd9a426b43f80f2a5848fcaa866b4fe9d06b2
SSDEEP 49152:Z2uahGTQz/ib8kcdxKzK1B6FXlafoZa4P//z0oBA5hq:MXGsGbvcdxKm1IDeA70o6Dq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim discovery trojan

Malware Config

Extracted

Family

nymaim

45.15.156.54
85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim

Executes dropped EXE 3 IoCs

pid	Process
1576	is-MUV9A.tmp
4008	dxsearcher48.exe
3752	PNxph.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	dxsearcher48.exe

Loads dropped DLL 1 IoCs

pid	Process
1576	is-MUV9A.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dxSearcher\unins000.dat	is-MUV9A.tmp
File created	C:\Program Files (x86)\dxSearcher\is-LC6VB.tmp	is-MUV9A.tmp
File created	C:\Program Files (x86)\dxSearcher\is-KCGO4.tmp	is-MUV9A.tmp
File created	C:\Program Files (x86)\dxSearcher\is-NQUKO.tmp	is-MUV9A.tmp
File created	C:\Program Files (x86)\dxSearcher\is-9AKR0.tmp	is-MUV9A.tmp
File created	C:\Program Files (x86)\dxSearcher\is-EBVUV.tmp	is-MUV9A.tmp
File created	C:\Program Files (x86)\dxSearcher\is-U3QTR.tmp	is-MUV9A.tmp
File created	C:\Program Files (x86)\dxSearcher\is-NNDAC.tmp	is-MUV9A.tmp
File created	C:\Program Files (x86)\dxSearcher\is-B59KS.tmp	is-MUV9A.tmp
File created	C:\Program Files (x86)\dxSearcher\is-E8EIS.tmp	is-MUV9A.tmp
File opened for modification	C:\Program Files (x86)\dxSearcher\unins000.dat	is-MUV9A.tmp
File opened for modification	C:\Program Files (x86)\dxSearcher\dxsearcher48.exe	is-MUV9A.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
4376	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4008	dxsearcher48.exe
4008	dxsearcher48.exe
4008	dxsearcher48.exe
4008	dxsearcher48.exe
4008	dxsearcher48.exe
4008	dxsearcher48.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4008	dxsearcher48.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4376	taskkill.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1576	2524	file.exe	82
PID 2524 wrote to memory of 1576	2524	file.exe	82
PID 2524 wrote to memory of 1576	2524	file.exe	82
PID 1576 wrote to memory of 4008	1576	is-MUV9A.tmp	83
PID 1576 wrote to memory of 4008	1576	is-MUV9A.tmp	83
PID 1576 wrote to memory of 4008	1576	is-MUV9A.tmp	83
PID 4008 wrote to memory of 3752	4008	dxsearcher48.exe	86
PID 4008 wrote to memory of 3752	4008	dxsearcher48.exe	86
PID 4008 wrote to memory of 3752	4008	dxsearcher48.exe	86
PID 4008 wrote to memory of 2000	4008	dxsearcher48.exe	87
PID 4008 wrote to memory of 2000	4008	dxsearcher48.exe	87
PID 4008 wrote to memory of 2000	4008	dxsearcher48.exe	87
PID 2000 wrote to memory of 4376	2000	cmd.exe	89
PID 2000 wrote to memory of 4376	2000	cmd.exe	89
PID 2000 wrote to memory of 4376	2000	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\is-CAHKH.tmp\is-MUV9A.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CAHKH.tmp\is-MUV9A.tmp" /SL4 $C0062 "C:\Users\Admin\AppData\Local\Temp\file.exe" 2262462 52736
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Program Files (x86)\dxSearcher\dxsearcher48.exe
    "C:\Program Files (x86)\dxSearcher\dxsearcher48.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Users\Admin\AppData\Roaming\{99cae5c0-1ab4-11ed-899c-806e6f6e6963}\PNxph.exe
      4⤵
      Executes dropped EXE
      PID:3752
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "dxsearcher48.exe" /f & erase "C:\Program Files (x86)\dxSearcher\dxsearcher48.exe" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2000
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "dxsearcher48.exe" /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dxsearcher48.exe

Path C:\Program Files (x86)\dxSearcher\dxsearcher48.exe
Size 4.0MB
SHA256 635cb47fabacd1809434d4864799fab477a5c949f15a284f32b245d9b92f3743
MD5 71975fbb8b737b2a054efe3758b8294e
SHA1 29b028390b172f7c298dcfb836b94b97abf29caa
SHA512 2b8f12fc5558df75b1b8859cf842d9b1cddd853472fca339e0f38ca8fd623d6fac75ae968f71c3f8fd747d5eb7a5a8a5dc55d80fcaea6db5b8ccf57e6966f07e
SSDEEP 49152:gAo2MYtvYtzYtFYtbYthYtidJ8MZR0B53jeifjsprsWmxAgkolNB:sMZR0B53jemjsls0g9B
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxsearcher48.exe

Path C:\Program Files (x86)\dxSearcher\dxsearcher48.exe
Size 4.0MB
SHA256 635cb47fabacd1809434d4864799fab477a5c949f15a284f32b245d9b92f3743
MD5 71975fbb8b737b2a054efe3758b8294e
SHA1 29b028390b172f7c298dcfb836b94b97abf29caa
SHA512 2b8f12fc5558df75b1b8859cf842d9b1cddd853472fca339e0f38ca8fd623d6fac75ae968f71c3f8fd747d5eb7a5a8a5dc55d80fcaea6db5b8ccf57e6966f07e
SSDEEP 49152:gAo2MYtvYtzYtFYtbYthYtidJ8MZR0B53jeifjsprsWmxAgkolNB:sMZR0B53jemjsls0g9B
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-9DJJV.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

is-MUV9A.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-CAHKH.tmp\is-MUV9A.tmp
Size 657KB
SHA256 e82cabb027db8846c3430be760f137afa164c36f9e1b93a6e34c96de0b2c5a5f
MD5 7cd12c54a9751ca6eee6ab0c85fb68f5
SHA1 76562e9b7888b6d20d67addb5a90b68b54a51987
SHA512 27ba5d2f719aaac2ead6fb42f23af3aa866f75026be897cd2f561f3e383904e89e6043bd22b4ae24f69787bd258a68ff696c09c03d656cbf7c79c2a52d8d82cc
SSDEEP 12288:CkxzRCUn4rP/37YzHXA6/YUKsGjQNw4qpRRpDWowphIxz:ZFRCUn4rP/37YzHXA6QJsoPtIpqxz
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-MUV9A.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-CAHKH.tmp\is-MUV9A.tmp
Size 657KB
SHA256 e82cabb027db8846c3430be760f137afa164c36f9e1b93a6e34c96de0b2c5a5f
MD5 7cd12c54a9751ca6eee6ab0c85fb68f5
SHA1 76562e9b7888b6d20d67addb5a90b68b54a51987
SHA512 27ba5d2f719aaac2ead6fb42f23af3aa866f75026be897cd2f561f3e383904e89e6043bd22b4ae24f69787bd258a68ff696c09c03d656cbf7c79c2a52d8d82cc
SSDEEP 12288:CkxzRCUn4rP/37YzHXA6/YUKsGjQNw4qpRRpDWowphIxz:ZFRCUn4rP/37YzHXA6QJsoPtIpqxz
MD5 SHA1 SHA512 SSDEEP

Submit Download

PNxph.exe

Path C:\Users\Admin\AppData\Roaming\{99cae5c0-1ab4-11ed-899c-806e6f6e6963}\PNxph.exe
Size 72KB
SHA256 27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
MD5 3fb36cb0b7172e5298d2992d42984d06
SHA1 439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA512 6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
SSDEEP 1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

PNxph.exe

Path C:\Users\Admin\AppData\Roaming\{99cae5c0-1ab4-11ed-899c-806e6f6e6963}\PNxph.exe
Size 72KB
SHA256 27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
MD5 3fb36cb0b7172e5298d2992d42984d06
SHA1 439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA512 6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
SSDEEP 1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2524-155-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2524-132-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2524-137-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4008-143-0x0000000000400000-0x00000000015F9000-memory.dmp

Download

memory/4008-144-0x0000000000400000-0x00000000015F9000-memory.dmp

Download

memory/4008-148-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/4008-142-0x0000000000400000-0x00000000015F9000-memory.dmp

Download

memory/4008-153-0x0000000000400000-0x00000000015F9000-memory.dmp

Download