Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    1.5MB

  • Sample

    230113-e5y94shh9w

  • MD5

    197a429834e309af6fab24b06722f095

  • SHA1

    20fd1f2f5f21e19109ea7675806a552b885f1cfe

  • SHA256

    d3b3987d53060af48006ce1a0527e598dea88be1211be824092361d1a1a35164

  • SHA512

    78d78fe8943de7e57f3c208fbfb777ea31cf7be0e72099af86a730c685c10af1f7381c9e4cb37385fceed1571ed2609164882a53736aadb42fa9b8265ff372fc

  • SSDEEP

    24576:D20FVXn/zpQyNp3CnFcF8zSqqR7LLE1g3gFDgrzvFuKAyr2/gFLVmWm+AR5Yf+kj:D2KVXtlCnrSZ1XwDgrbYF/gFpRdakATY

Score
10/10
nymaimdiscoverytrojan

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Targets

    • Target

      file.exe

    • Size

      1.5MB

    • MD5

      197a429834e309af6fab24b06722f095

    • SHA1

      20fd1f2f5f21e19109ea7675806a552b885f1cfe

    • SHA256

      d3b3987d53060af48006ce1a0527e598dea88be1211be824092361d1a1a35164

    • SHA512

      78d78fe8943de7e57f3c208fbfb777ea31cf7be0e72099af86a730c685c10af1f7381c9e4cb37385fceed1571ed2609164882a53736aadb42fa9b8265ff372fc

    • SSDEEP

      24576:D20FVXn/zpQyNp3CnFcF8zSqqR7LLE1g3gFDgrzvFuKAyr2/gFLVmWm+AR5Yf+kj:D2KVXtlCnrSZ1XwDgrbYF/gFpRdakATY

    Score
    10/10
    nymaimdiscoverytrojan

    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

      trojannymaim

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks