mimikatz | e058280f4b15c1be6488049e0bdba555f1baf42e139b7251d6b2c230e28e0aef | Triage

Analysis

max time kernel
126s
max time network
135s
platform
windows7_x64
resource
win7v20201028
submitted
17-03-2021 16:21

Sharing

Report Analysis Logs

General

Target

32bit_decompressed.dll
Size

68KB
MD5

9774b2e5e34269bc3adc01d73bdfa76a
SHA1

adc27dc8a9e33cc2c7684bf47d5cc98d0bdc7958
SHA256

e058280f4b15c1be6488049e0bdba555f1baf42e139b7251d6b2c230e28e0aef
SHA512

90cefd6e4836d4a26f59f551a33a5b4d1cd45891156211e706ad72d16539a3dacda3da69c796e70b3bb6d141820ec2ac2d063a58657a27067f4662d3fa7b7516

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1656-4-0x0000000074960000-0x0000000074974000-memory.dmp	mimikatz

Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

2 1656 rundll32.exe
4 1656 rundll32.exe
5 1656 rundll32.exe
6 1656 rundll32.exe
7 1656 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1152 wrote to memory of 1656	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1656	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1656	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1656	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1656	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1656	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1656	1152	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit_decompressed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit_decompressed.dll,#1
2⤵
- Blocklisted process makes network request
PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-2-0x0000000000000000-mapping.dmp

Download
memory/1656-3-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download
memory/1656-4-0x0000000074960000-0x0000000074974000-memory.dmp

Filesize
80KB

Download