Behavioral task
behavioral1
Sample
6a651991a08f875ff5ca9e149b3f16f582239d830fbe88fc3b59cf2980a0d9bd.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
6a651991a08f875ff5ca9e149b3f16f582239d830fbe88fc3b59cf2980a0d9bd.exe
Resource
win10v2004-20230621-en
General
-
Target
6a651991a08f875ff5ca9e149b3f16f582239d830fbe88fc3b59cf2980a0d9bd
-
Size
123KB
-
MD5
43cb1f38b0f109970e9b44c539c84944
-
SHA1
e8eaf43c609879c640da19ec7024972e7076b95c
-
SHA256
6a651991a08f875ff5ca9e149b3f16f582239d830fbe88fc3b59cf2980a0d9bd
-
SHA512
c5d5e9320e7c8467048d09027a6d5d88f6cb224cc20f924f26396d7428de130a5d35cebcb53bbfd9aad2e460961978c819bf18a24f88605bcbc43bc45c2c5d68
-
SSDEEP
3072:KhhBDyg/PHGXSb8irOsqNoTri2P2JLbHfxRukG7Kz5L0aodtq2u/l:KZDygFb8iyh+TrHSLDPrg
Malware Config
Signatures
-
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule sample mimikatz -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a651991a08f875ff5ca9e149b3f16f582239d830fbe88fc3b59cf2980a0d9bd
Files
-
6a651991a08f875ff5ca9e149b3f16f582239d830fbe88fc3b59cf2980a0d9bd.exe windows x64
cfa02385b0020234026ce5f257a82900
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
ConvertSidToStringSidW
CredIsMarshaledCredentialW
CredUnmarshalCredentialW
IsTextUnicode
ole32
CoUninitialize
CoInitializeEx
shell32
CommandLineToArgvW
user32
IsCharAlphaNumericW
msasn1
ASN1_CreateModule
ASN1_CloseEncoder
ASN1_CloseDecoder
ASN1_CreateEncoder
ASN1_CloseModule
ASN1_CreateDecoder
ntdll
NtQuerySystemInformation
RtlInitUnicodeString
RtlGetCurrentPeb
NtQueryInformationProcess
RtlEqualUnicodeString
RtlGetNtVersionNumbers
RtlAdjustPrivilege
RtlEqualString
kernel32
GetProcessHeap
SetEndOfFile
HeapSize
GetStringTypeW
LCMapStringW
WriteConsoleW
LoadLibraryW
HeapReAlloc
HeapAlloc
MultiByteToWideChar
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
GetVersion
HeapSetInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
FlsAlloc
GetCurrentThreadId
SetLastError
FlsFree
FlsSetValue
FlsGetValue
IsValidCodePage
GetOEMCP
GetACP
FileTimeToSystemTime
LocalAlloc
LocalFree
ExpandEnvironmentStringsW
GetLastError
DeviceIoControl
SetFilePointer
WriteFile
ReadProcessMemory
ReadFile
WriteProcessMemory
GetConsoleOutputCP
SetConsoleOutputCP
GetCurrentProcess
GetDateFormatW
GetSystemTimeAsFileTime
WideCharToMultiByte
GetTimeFormatW
FileTimeToLocalFileTime
ExitProcess
SetConsoleCtrlHandler
SetConsoleTitleW
OpenProcess
CreateFileW
CloseHandle
GetProcAddress
FreeLibrary
LoadLibraryA
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
TerminateProcess
RtlUnwindEx
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
Sleep
HeapFree
GetModuleHandleW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
GetCPInfo
Sections
.text Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ