Analysis

  • max time kernel
    83s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/12/2022, 04:22

General

  • Target

    cc58143048294ff5fd4eb525b9af83bd.exe

  • Size

    385KB

  • MD5

    cc58143048294ff5fd4eb525b9af83bd

  • SHA1

    10c859ebdd0207d13a4b07d62a5b1df9ba447502

  • SHA256

    43209724f0bd10e551388117ec98e9b22a296537b1c1eb6f6bc2b35239e63544

  • SHA512

    8e385d7cbf4f7fe55732a194456c56398b1c93d8271ac8c767a361f57e0e0b754b972f64acba710a0b20937a62fab2dadbde8e08b925c5f441307b541851e35c

  • SSDEEP

    6144:CGpL5+6yz3wmdCSBV4TbDX1gYd6jt8p4RR0cSpQTtyzsduHNIv:Bp9+6yzgJbZgbt8p4RR0TCtyYduHNI

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Signatures

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 10 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc58143048294ff5fd4eb525b9af83bd.exe
    "C:\Users\Admin\AppData\Local\Temp\cc58143048294ff5fd4eb525b9af83bd.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 456
      2⤵
      • Program crash
      PID:4592
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 764
      2⤵
      • Program crash
      PID:4872
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 772
      2⤵
      • Program crash
      PID:3056
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 792
      2⤵
      • Program crash
      PID:5116
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 776
      2⤵
      • Program crash
      PID:4356
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 928
      2⤵
      • Program crash
      PID:1276
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 1004
      2⤵
      • Program crash
      PID:792
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 1036
      2⤵
      • Program crash
      PID:1716
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 1236
      2⤵
      • Program crash
      PID:1580
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "cc58143048294ff5fd4eb525b9af83bd.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\cc58143048294ff5fd4eb525b9af83bd.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3776
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "cc58143048294ff5fd4eb525b9af83bd.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1540
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 536
      2⤵
      • Program crash
      PID:1720
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 764 -ip 764
    1⤵
      PID:1984
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 764 -ip 764
      1⤵
        PID:1052
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 764 -ip 764
        1⤵
          PID:2940
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 764 -ip 764
          1⤵
            PID:4392
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 764 -ip 764
            1⤵
              PID:4028
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 764 -ip 764
              1⤵
                PID:4980
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 764 -ip 764
                1⤵
                  PID:2040
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 764 -ip 764
                  1⤵
                    PID:1336
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 764 -ip 764
                    1⤵
                      PID:2668
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 764 -ip 764
                      1⤵
                        PID:2704

                      Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • memory/764-132-0x00000000004FE000-0x0000000000525000-memory.dmp

                              Filesize

                              156KB

                            • memory/764-133-0x0000000002090000-0x00000000020D0000-memory.dmp

                              Filesize

                              256KB

                            • memory/764-134-0x0000000000400000-0x0000000000466000-memory.dmp

                              Filesize

                              408KB

                            • memory/764-137-0x00000000004FE000-0x0000000000525000-memory.dmp

                              Filesize

                              156KB

                            • memory/764-138-0x0000000000400000-0x0000000000466000-memory.dmp

                              Filesize

                              408KB