nymaim | f9e6ab0561dd77f4eb3fbecd567bc90051d61844b8cdbd239324899fbae50263

General

Target

f9e6ab0561dd77f4eb3fbecd567bc90051d61844b8cdbd239324899fbae50263.exe
Size

394KB
MD5

7ac7e51e2687cd03650a91aff4949837
SHA1

59c6ceb2727b30d76d197107e4b0c4a5527ab19b
SHA256

f9e6ab0561dd77f4eb3fbecd567bc90051d61844b8cdbd239324899fbae50263
SHA512

c7bfc291f3ea98e1e68106904f7b306e8b1bc31582a7f77e98e729b6018e9e6756d33b2869865225104d0cc3f6b0ea90b70c62c73faf97f0ee8895272c72dc8c
SSDEEP

6144:0hYVz4L472IMIEp7d9JiStvhz5AYiYCTsPcijrG7ITsq:0hYec72B1JimhiYCTsPV3G7

Score

10^/10

nymaim trojan

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	f9e6ab0561dd77f4eb3fbecd567bc90051d61844b8cdbd239324899fbae50263.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
3024	516	WerFault.exe	81
4972	516	WerFault.exe	81
4832	516	WerFault.exe	81
1560	516	WerFault.exe	81
1768	516	WerFault.exe	81
1420	516	WerFault.exe	81
772	516	WerFault.exe	81
4028	516	WerFault.exe	81
4128	516	WerFault.exe	81
2296	516	WerFault.exe	81

Kills process with taskkill 1 IoCs

evasion

pid	Process
3096	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3096	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 4048	516	f9e6ab0561dd77f4eb3fbecd567bc90051d61844b8cdbd239324899fbae50263.exe	106
PID 516 wrote to memory of 4048	516	f9e6ab0561dd77f4eb3fbecd567bc90051d61844b8cdbd239324899fbae50263.exe	106
PID 516 wrote to memory of 4048	516	f9e6ab0561dd77f4eb3fbecd567bc90051d61844b8cdbd239324899fbae50263.exe	106
PID 4048 wrote to memory of 3096	4048	cmd.exe	110
PID 4048 wrote to memory of 3096	4048	cmd.exe	110
PID 4048 wrote to memory of 3096	4048	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\f9e6ab0561dd77f4eb3fbecd567bc90051d61844b8cdbd239324899fbae50263.exe
"C:\Users\Admin\AppData\Local\Temp\f9e6ab0561dd77f4eb3fbecd567bc90051d61844b8cdbd239324899fbae50263.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 452
  2⤵
  - Program crash
  PID:3024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 764
  2⤵
  - Program crash
  PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 804
  2⤵
  - Program crash
  PID:4832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 804
  2⤵
  - Program crash
  PID:1560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 764
  2⤵
  - Program crash
  PID:1768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 920
  2⤵
  - Program crash
  PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 900
  2⤵
  - Program crash
  PID:772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 1060
  2⤵
  - Program crash
  PID:4028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 1336
  2⤵
  - Program crash
  PID:4128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "f9e6ab0561dd77f4eb3fbecd567bc90051d61844b8cdbd239324899fbae50263.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f9e6ab0561dd77f4eb3fbecd567bc90051d61844b8cdbd239324899fbae50263.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "f9e6ab0561dd77f4eb3fbecd567bc90051d61844b8cdbd239324899fbae50263.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 1396
  2⤵
  - Program crash
  PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 516 -ip 516
1⤵
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 516 -ip 516
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 516 -ip 516
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 516 -ip 516
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 516 -ip 516
1⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 516 -ip 516
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 516 -ip 516
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 516 -ip 516
1⤵
PID:996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 516 -ip 516
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 516 -ip 516
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/516-132-0x0000000002CB3000-0x0000000002CD9000-memory.dmp

Filesize
152KB

Download
memory/516-133-0x0000000002FF0000-0x0000000003030000-memory.dmp

Filesize
256KB

Download
memory/516-134-0x0000000000400000-0x0000000002C51000-memory.dmp

Filesize
40.3MB

Download
memory/516-137-0x0000000000400000-0x0000000002C51000-memory.dmp

Filesize
40.3MB

Download

Analysis

Sharing