nymaim | 7831572c8567907b57684441a3f85d189d3237be4f35b40408d392772b112512

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2023, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ca85dac7dd6992bdaeef905d62bd511.exe
Size 381KB
Sample230106-lnrx2afe95
SHA256 7831572c8567907b57684441a3f85d189d3237be4f35b40408d392772b112512
MD5 6ca85dac7dd6992bdaeef905d62bd511
SHA1 c9c9f7ce531c2b56f83309286c8de2f37787c26a
SHA512 d1755e320922a745eb7bca95a0a91748b1999e83cc056821e82a1ccbb38980c9da00351e4794b88bce4a8d081debe9f9e7696ff2292c5970dd628cbc90ac8a99
SSDEEP 6144:4W3LW58rpay6bNeO38EomzJBkOmdWKQj/oo:4yy58rfjgjZkOgbHo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim trojan

Malware Config

Extracted

Family

nymaim

45.139.105.171
85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	6ca85dac7dd6992bdaeef905d62bd511.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
2912	4264	WerFault.exe	79
916	4264	WerFault.exe	79
4160	4264	WerFault.exe	79
4340	4264	WerFault.exe	79
4400	4264	WerFault.exe	79
1128	4264	WerFault.exe	79
4412	4264	WerFault.exe	79
4532	4264	WerFault.exe	79

Kills process with taskkill 1 IoCs

evasion

pid	Process
4800	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 1132	4264	6ca85dac7dd6992bdaeef905d62bd511.exe	101
PID 4264 wrote to memory of 1132	4264	6ca85dac7dd6992bdaeef905d62bd511.exe	101
PID 4264 wrote to memory of 1132	4264	6ca85dac7dd6992bdaeef905d62bd511.exe	101
PID 1132 wrote to memory of 4800	1132	cmd.exe	103
PID 1132 wrote to memory of 4800	1132	cmd.exe	103
PID 1132 wrote to memory of 4800	1132	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\6ca85dac7dd6992bdaeef905d62bd511.exe
"C:\Users\Admin\AppData\Local\Temp\6ca85dac7dd6992bdaeef905d62bd511.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 456
  2⤵
  - Program crash
  PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 756
  2⤵
  - Program crash
  PID:916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 804
  2⤵
  - Program crash
  PID:4160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 848
  2⤵
  - Program crash
  PID:4340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 868
  2⤵
  - Program crash
  PID:4400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 928
  2⤵
  - Program crash
  PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 932
  2⤵
  - Program crash
  PID:4412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 1364
  2⤵
  - Program crash
  PID:4532
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "6ca85dac7dd6992bdaeef905d62bd511.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\6ca85dac7dd6992bdaeef905d62bd511.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "6ca85dac7dd6992bdaeef905d62bd511.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4264 -ip 4264
1⤵
PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4264 -ip 4264
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4264 -ip 4264
1⤵
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4264 -ip 4264
1⤵
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4264 -ip 4264
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4264 -ip 4264
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4264 -ip 4264
1⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4264 -ip 4264
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4264-132-0x0000000002CC7000-0x0000000002CEE000-memory.dmp

Download

memory/4264-133-0x0000000002DD0000-0x0000000002E10000-memory.dmp

Download

memory/4264-134-0x0000000000400000-0x0000000002C51000-memory.dmp

Download

memory/4264-136-0x0000000002CC7000-0x0000000002CEE000-memory.dmp

Download

memory/4264-138-0x0000000000400000-0x0000000002C51000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads