mimikatz | 32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471 | Triage

Submit
Reports

Overview

overview

Static

static

32efb1eb36...71.exe

windows7_x64

32efb1eb36...71.exe

windows10_x64

Resubmissions

26-08-2024 09:41

240826-ln48csyerj 10

29-01-2022 07:52

220129-jqhe9sgcg5 10

Sharing

General

Target

32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471
Size

1.8MB
Sample

220129-jqhe9sgcg5
MD5

59c3f3f99f44029de81293b1e7c37ed2
SHA1

fb07496900468529719f07ed4b7432ece97a8d3d
SHA256

32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471
SHA512

9b3bd8a76d754bf9c899111be986c4fd6d14f6993a9a0e3dcd9b4a76c0f7764ac8798f5cbc7a0467c1562638d85bf52f627bd32c125f587b1e838beaf03c8a0e

Score

10^/10

mimikatz discovery evasion ransomware spyware stealer

Static task

static1

Behavioral task

behavioral1

Sample

32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471.exe

Resource

win7-en-20211208

mimikatz discovery evasion ransomware spyware stealer

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471.exe

Resource

win10-en-20211208

mimikatz discovery evasion ransomware spyware stealer

windows10_x64

0 signatures

0 seconds

Malware Config

Targets

- Target
  
  32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471
- Size
  
  1.8MB
- MD5
  
  59c3f3f99f44029de81293b1e7c37ed2
- SHA1
  
  fb07496900468529719f07ed4b7432ece97a8d3d
- SHA256
  
  32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471
- SHA512
  
  9b3bd8a76d754bf9c899111be986c4fd6d14f6993a9a0e3dcd9b4a76c0f7764ac8798f5cbc7a0467c1562638d85bf52f627bd32c125f587b1e838beaf03c8a0e
Score

10^/10

mimikatz discovery evasion ransomware spyware stealer
- Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- Clears Windows event logs
  evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- mimikatz is an open source tool to dump credentials on Windows
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Indicator Removal on Host

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

mimikatzdiscoveryevasionransomwarespywarestealer

behavioral2

mimikatzdiscoveryevasionransomwarespywarestealer

© 2018-2025

Terms | Privacy