General

  • Target

    file.exe

  • Size

    1.5MB

  • Sample

    230112-wlwhjsha55

  • MD5

    495ec9f487ebdac52568aa394f1db615

  • SHA1

    3893a7d5f9f91b9f2b2a3d7bbb5483c9ae5b385a

  • SHA256

    d229f2520f6ed70a022a6333483e844c35d792744a883fde05f03dd2a3fd7420

  • SHA512

    d7b7ee9da30fb52082f453156aec3932cbf40604fd6e4b5bc8a5458d731685a841674b784fd4957b9eed8d3159534585ae8234a9fb36d9cf06d34f2ac1e29de5

  • SSDEEP

    24576:220Sx+J5xUVuvxlj4J6DPZwVA3OQVFgcfsNfkhUyFtc/7Zf+BXMgXC75ld1qSVpk:228wubE6uBQVtfsN0R+/tOEd1qapk

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Targets

    • Target

      file.exe

    • Size

      1.5MB

    • MD5

      495ec9f487ebdac52568aa394f1db615

    • SHA1

      3893a7d5f9f91b9f2b2a3d7bbb5483c9ae5b385a

    • SHA256

      d229f2520f6ed70a022a6333483e844c35d792744a883fde05f03dd2a3fd7420

    • SHA512

      d7b7ee9da30fb52082f453156aec3932cbf40604fd6e4b5bc8a5458d731685a841674b784fd4957b9eed8d3159534585ae8234a9fb36d9cf06d34f2ac1e29de5

    • SSDEEP

      24576:220Sx+J5xUVuvxlj4J6DPZwVA3OQVFgcfsNfkhUyFtc/7Zf+BXMgXC75ld1qSVpk:228wubE6uBQVtfsN0R+/tOEd1qapk

    Score
    10/10
    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks