nymaim | 1d3c373c6c13ef2cb5759cd5f136b809d69bcd241f7a9dc035984078960efdeb

Analysis

max time kernel
99s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-10-2022 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

312KB
MD5

cd5f94ff8af11553bfd4cb5aed55c38b
SHA1

66bde5a6114c4185dab033138436f2ef5ed108f6
SHA256

1d3c373c6c13ef2cb5759cd5f136b809d69bcd241f7a9dc035984078960efdeb
SHA512

c319804a38a3577ac5e148436a4a3cc0bba747ce6720b4235287a55d47f8405a9709fd0c2e8588cf0be0335b28e4d11e097bb537639af2ee5d15c77cef39c6ef
SSDEEP

6144:MdQoLdmeeE7sCM7Oh5bZpXmxaY3bMRgjHAqGOgrV:MdVxme17snOhdHXlmbMyjHuv

Score

10^/10

nymaim trojan

Malware Config

Extracted

Family

nymaim

45.139.105.171

85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
4792	2604	WerFault.exe	84
4216	2604	WerFault.exe	84
532	2604	WerFault.exe	84
3116	2604	WerFault.exe	84
2540	2604	WerFault.exe	84
2312	2604	WerFault.exe	84
4820	2604	WerFault.exe	84
1112	2604	WerFault.exe	84
3996	2604	WerFault.exe	84

Kills process with taskkill 1 IoCs

evasion

pid	Process
3208	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3208	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 1104	2604	tmp.exe	105
PID 2604 wrote to memory of 1104	2604	tmp.exe	105
PID 2604 wrote to memory of 1104	2604	tmp.exe	105
PID 1104 wrote to memory of 3208	1104	cmd.exe	109
PID 1104 wrote to memory of 3208	1104	cmd.exe	109
PID 1104 wrote to memory of 3208	1104	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 460
  2⤵
  - Program crash
  PID:4792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 764
  2⤵
  - Program crash
  PID:4216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 808
  2⤵
  - Program crash
  PID:532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 808
  2⤵
  - Program crash
  PID:3116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 764
  2⤵
  - Program crash
  PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 932
  2⤵
  - Program crash
  PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 932
  2⤵
  - Program crash
  PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 1356
  2⤵
  - Program crash
  PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "tmp.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\tmp.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "tmp.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 1280
  2⤵
  - Program crash
  PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2604 -ip 2604
1⤵
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2604 -ip 2604
1⤵
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2604 -ip 2604
1⤵
PID:204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2604 -ip 2604
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2604 -ip 2604
1⤵
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2604 -ip 2604
1⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2604 -ip 2604
1⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2604 -ip 2604
1⤵
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2604 -ip 2604
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-135-0x0000000000000000-mapping.dmp

Download
memory/2604-132-0x0000000002E23000-0x0000000002E4A000-memory.dmp

Filesize
156KB

Download
memory/2604-133-0x0000000002D90000-0x0000000002DD0000-memory.dmp

Filesize
256KB

Download
memory/2604-134-0x0000000000400000-0x0000000002C3B000-memory.dmp

Filesize
40.2MB

Download
memory/2604-137-0x0000000002E23000-0x0000000002E4A000-memory.dmp

Filesize
156KB

Download
memory/2604-138-0x0000000000400000-0x0000000002C3B000-memory.dmp

Filesize
40.2MB

Download
memory/3208-136-0x0000000000000000-mapping.dmp

Download