Behavioral task
behavioral1
Sample
6e72e4ce814295exeexeexeex.exe
Resource
win7-20230703-en
General
-
Target
6e72e4ce814295exeexeexeex.exe
-
Size
8.8MB
-
MD5
6e72e4ce8142959570ae6a9c02182eae
-
SHA1
fabe00c0a38635bd286d0f635724b8d6999d6dd0
-
SHA256
2c9bc80ad1f7f1a73f4ca3e0f55efc56f05303e8a3dc8a57f6c6c4af8512f8a9
-
SHA512
61ac7aa94999fc6cc93478796dc5693eebaf85a5238bf61b0cc48553215f04678386470ad7fd335d634d9f92b8270dfe9eb4afa853524165c43884dc4840340b
-
SSDEEP
196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1
Malware Config
Signatures
-
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule sample mimikatz -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e72e4ce814295exeexeexeex.exe -
NSIS installer 1 IoCs
resource yara_rule sample nsis_installer_2
Files
-
6e72e4ce814295exeexeexeex.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 740KB - Virtual size: 738KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ