Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    27b26cf6ba3ddaeeb8f2d14b2868ea2229f3bf951cb6a2cccc73e207a08cbdcd

  • Size

    755KB

  • Sample

    230112-ylzlbaae22

  • MD5

    c296f6d7c3ce6dad67003a5777a6da0a

  • SHA1

    b426f52cf2419af5c4829c65857ff4f873565ef0

  • SHA256

    27b26cf6ba3ddaeeb8f2d14b2868ea2229f3bf951cb6a2cccc73e207a08cbdcd

  • SHA512

    db969b2f9c0b1d8c9d2893c6418251a1a1765e3708a327ef6f7034f76a1dda86b1f695a8784e314acaeff8d33efc618164c48b740a9268871b2d199e64975b6b

  • SSDEEP

    12288:VQi3sc6m6UR0IeSp1hf39Wkv8xwJld8kO:VQi8zHIeSpdUMkkO

Score
10/10
nymaimdiscoveryevasionpersistencetrojan

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Targets

    • Target

      27b26cf6ba3ddaeeb8f2d14b2868ea2229f3bf951cb6a2cccc73e207a08cbdcd

    • Size

      755KB

    • MD5

      c296f6d7c3ce6dad67003a5777a6da0a

    • SHA1

      b426f52cf2419af5c4829c65857ff4f873565ef0

    • SHA256

      27b26cf6ba3ddaeeb8f2d14b2868ea2229f3bf951cb6a2cccc73e207a08cbdcd

    • SHA512

      db969b2f9c0b1d8c9d2893c6418251a1a1765e3708a327ef6f7034f76a1dda86b1f695a8784e314acaeff8d33efc618164c48b740a9268871b2d199e64975b6b

    • SSDEEP

      12288:VQi3sc6m6UR0IeSp1hf39Wkv8xwJld8kO:VQi8zHIeSpdUMkkO

    Score
    10/10
    nymaimdiscoveryevasionpersistencetrojan

    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

      trojannymaim

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

      evasion

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Software Discovery

1
T1518

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks