Behavioral task
behavioral1
Sample
2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2.exe
Resource
win10v2004-20230220-en
General
-
Target
2.exe
-
Size
627KB
-
MD5
a6ef79acdcd0d2eaf54d2fa39e421c05
-
SHA1
bac13caa15dc7e86350fcfe6b65f7740431123b3
-
SHA256
9369b34df04a2795de083401dda4201a2da2784d1384a6ada2d773b3a81f8dad
-
SHA512
e57a838b42e7f7e76cc009ba9a423814c4136870e38380dbf06b1386155cbe9b259cd118ad217371f4be1a4e6586e38f41566505a8ed0d5d59ca496e1b1ef84b
-
SSDEEP
12288:plGNnZnboGFZSqFt5VGxfwZACUZa+UWz/5+ga:ynZHeAtLACAa+X/o
Malware Config
Signatures
-
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule sample mimikatz -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2.exe
Files
-
2.exe.exe windows x86
214cccffb2136a0559ff0c2324b226ba
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptSetHashParam
CryptGetHashParam
CryptExportKey
CryptAcquireContextW
CryptSetKeyParam
CryptGetKeyParam
CryptReleaseContext
CryptDuplicateKey
CryptAcquireContextA
CryptGetProvParam
CryptImportKey
SystemFunction007
CryptEncrypt
CryptCreateHash
CryptGenKey
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
CopySid
GetLengthSid
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
CreateWellKnownSid
CreateProcessWithLogonW
CreateProcessAsUserW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
SystemFunction032
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
SetServiceObjectSecurity
OpenServiceW
BuildSecurityDescriptorW
QueryServiceObjectSecurity
StartServiceW
AllocateAndInitializeSid
QueryServiceStatusEx
FreeSid
ControlService
IsTextUnicode
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
DuplicateTokenEx
CheckTokenMembership
ConvertStringSidToSidW
LsaFreeMemory
CryptSetProvParam
CryptEnumProvidersW
CryptEnumProviderTypesW
SystemFunction006
CryptGetUserKey
OpenEventLogW
GetNumberOfEventLogRecords
ClearEventLogW
GetSidSubAuthority
SystemFunction001
GetSidSubAuthorityCount
SystemFunction005
LsaQueryTrustedDomainInfoByName
SystemFunction025
LsaOpenSecret
LsaQuerySecret
SystemFunction013
LsaRetrievePrivateData
LsaEnumerateTrustedDomainsEx
LookupPrivilegeValueW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
IsValidSid
LookupPrivilegeNameW
OpenThreadToken
SetThreadToken
CredFree
CredEnumerateW
A_SHAUpdate
A_SHAFinal
A_SHAInit
crypt32
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CertSetCertificateContextProperty
PFXExportCertStoreEx
CryptUnprotectData
CryptBinaryToStringW
CryptStringToBinaryW
CryptProtectData
CryptExportPublicKeyInfo
CryptAcquireCertificatePrivateKey
CertNameToStrW
CertGetNameStringW
CertAddCertificateContextToStore
CertFindCertificateInStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CryptSignAndEncodeCertificate
CertEnumSystemStore
CryptEncodeObject
cryptdll
CDLocateCheckSum
MD5Final
MD5Update
MD5Init
CDLocateCSystem
CDGenerateRandomBits
netapi32
NetStatisticsGet
DsGetDcNameW
NetApiBufferFree
NetRemoteTOD
NetSessionEnum
NetServerGetInfo
NetShareEnum
NetWkstaUserEnum
I_NetServerAuthenticate2
I_NetServerTrustPasswordsGet
I_NetServerReqChallenge
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
SysAllocString
VariantInit
SysFreeString
rpcrt4
MesHandleFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
MesEncodeIncrementalHandleCreate
RpcBindingSetAuthInfoExW
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcImpersonateClient
RpcBindingFree
RpcStringFreeW
RpcRevertToSelf
MesDecodeIncrementalHandleCreate
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeFree2
NdrMesTypeEncode2
I_RpcBindingInqSecurityContext
NdrServerCall2
NdrClientCall2
UuidCreate
RpcEpResolveBinding
RpcServerUnregisterIfEx
RpcMgmtEpEltInqDone
RpcServerInqBindings
RpcServerListen
RpcEpRegisterW
RpcMgmtStopServerListening
RpcBindingToStringBindingW
RpcServerRegisterIf2
RpcServerRegisterAuthInfoW
RpcBindingVectorFree
RpcMgmtEpEltInqNextW
RpcServerUseProtseqEpW
RpcMgmtEpEltInqBegin
RpcEpUnregister
shlwapi
PathFindFileNameW
PathCombineW
PathCanonicalizeW
PathIsRelativeW
PathIsDirectoryW
samlib
SamRidToSid
SamQueryInformationUser
SamCloseHandle
SamEnumerateDomainsInSamServer
SamFreeMemory
SamEnumerateUsersInDomain
SamOpenUser
SamLookupDomainInSamServer
SamLookupNamesInDomain
SamLookupIdsInDomain
SamOpenDomain
SamConnect
SamSetInformationUser
SamiChangePasswordUser
SamEnumerateGroupsInDomain
SamGetGroupsForUser
SamGetMembersInGroup
SamOpenAlias
SamOpenGroup
SamGetAliasMembership
SamEnumerateAliasesInDomain
SamGetMembersInAlias
secur32
LsaFreeReturnBuffer
LsaDeregisterLogonProcess
QueryContextAttributesW
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage
FreeContextBuffer
LsaConnectUntrusted
shell32
CommandLineToArgvW
user32
GetKeyboardLayout
IsCharAlphaNumericW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
hid
HidD_GetPreparsedData
HidD_GetHidGuid
HidD_GetAttributes
HidD_FreePreparsedData
HidP_GetCaps
setupapi
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
winscard
SCardReleaseContext
SCardGetAttrib
SCardEstablishContext
SCardFreeMemory
SCardListCardsW
SCardGetCardTypeProviderNameW
SCardDisconnect
SCardListReadersW
SCardConnectW
winsta
WinStationConnectW
WinStationFreeMemory
WinStationOpenServerW
WinStationEnumerateW
WinStationCloseServer
WinStationQueryInformationW
wldap32
ord41
ord127
ord79
ord310
ord73
ord301
ord304
ord309
ord26
ord54
ord36
ord145
ord208
ord167
ord133
ord142
ord77
ord27
ord13
ord147
msasn1
ASN1_CreateModule
ASN1_CloseEncoder
ASN1_CreateDecoder
ASN1_FreeEncoded
ASN1_CloseModule
ASN1_CreateEncoder
ASN1_CloseDecoder
ASN1BERDotVal2Eoid
ntdll
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlDowncaseUnicodeString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlEqualUnicodeString
NtQueryObject
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
NtQuerySystemInformation
RtlGetCurrentPeb
NtQueryInformationProcess
RtlCreateUserThread
RtlGUIDFromString
RtlStringFromGUID
NtCompareTokens
RtlGetNtVersionNumbers
RtlUpcaseUnicodeString
RtlAppendUnicodeStringToString
RtlAnsiStringToUnicodeString
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
NtResumeProcess
RtlAdjustPrivilege
NtSuspendProcess
NtTerminateProcess
NtQuerySystemEnvironmentValueEx
NtSetSystemEnvironmentValueEx
NtEnumerateSystemEnvironmentValuesEx
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
RtlEqualString
kernel32
RtlUnwind
FormatMessageA
GetSystemTimeAsFileTime
GetProcessHeap
UnlockFileEx
GetTickCount
OutputDebugStringW
WaitForSingleObjectEx
LockFile
FlushViewOfFile
LoadLibraryA
InterlockedExchange
GetProcessId
UnlockFile
InterlockedCompareExchange
HeapFree
QueryPerformanceCounter
SystemTimeToFileTime
HeapAlloc
SetEndOfFile
TryEnterCriticalSection
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
FileTimeToLocalFileTime
GetTimeFormatW
WideCharToMultiByte
GetDateFormatW
lstrlenW
CreateRemoteThread
WaitForSingleObject
SetLastError
CreateProcessW
SetConsoleOutputCP
GetConsoleOutputCP
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
WriteProcessMemory
VirtualProtect
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
ReadProcessMemory
VirtualFreeEx
VirtualQueryEx
VirtualFree
VirtualQuery
SetFilePointer
DeviceIoControl
DuplicateHandle
OpenProcess
GetCurrentProcess
ExpandEnvironmentStringsW
FindNextFileW
FindClose
GetCurrentDirectoryW
GetFileSizeEx
FlushFileBuffers
GetFileAttributesW
FindFirstFileW
CreateThread
LocalFree
CloseHandle
LocalAlloc
GetLastError
CreateFileW
ReadFile
Sleep
TerminateThread
WriteFile
FileTimeToSystemTime
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
InitializeCriticalSection
HeapCreate
HeapValidate
MultiByteToWideChar
GetTempPathW
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
CreateFileMappingA
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
ExitProcess
TerminateProcess
UnhandledExceptionFilter
GetVersion
GetModuleHandleA
GetCurrentThreadId
SetUnhandledExceptionFilter
RaiseException
SetConsoleCtrlHandler
SetConsoleTitleW
lstrlenA
FreeLibrary
LoadLibraryW
GetProcAddress
GetModuleHandleW
SetHandleInformation
CreatePipe
SetEvent
CreateEventW
SetConsoleCursorPosition
GetTimeZoneInformation
GetStdHandle
FillConsoleOutputCharacterW
GetComputerNameExW
GetConsoleScreenBufferInfo
IsWow64Process
SetCurrentDirectoryW
GetCurrentThread
ProcessIdToSessionId
msvcrt
?terminate@@YAXXZ
wcstombs
iswctype
ferror
wctomb
_itoa
_controlfp
localeconv
isxdigit
isleadbyte
__mb_cur_max
mbtowc
isspace
isdigit
calloc
__set_app_type
__p__fmode
__badioinfo
__pioinfo
_read
_lseeki64
_write
_isatty
ungetc
_snprintf
_iob
__p__commode
__setusermatherr
_amsg_exit
_initterm
_errno
free
_wcsdup
_wcsicmp
vfwprintf
_vscwprintf
fflush
_wfopen
wprintf
_fileno
_except_handler3
vwprintf
_setmode
fclose
wcsrchr
wcschr
_stricmp
strrchr
strtoul
_wcsnicmp
wcsstr
gmtime
memmove
malloc
_msize
strftime
realloc
fgetws
wcstoul
wcstol
towupper
_wpgmptr
memset
memcpy
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
Sections
.text Size: 369KB - Virtual size: 368KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 209KB - Virtual size: 209KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ