mimikatz

General

Target

7676c93819e3fbexeexeexeex.exe
Size

8.1MB
Sample

230708-y8l9haah41
MD5

7676c93819e3fba566458677d29b3342
SHA1

b4ad74caf8c825aa0f083c3e588d050fcfc56ae5
SHA256

0ff18437b4b6872b2292d1e13280eb206050543e71d1e169132e4ed2ced0d778
SHA512

2a348d506c7eaec0380c3898ee50aecd91cd2e12a08e2d2ba5364ec8bbb5a5bcc47efddf322d3745423f427b800fc1995513461811f2f5f4a8b264c1c9629129
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

Malware Config

Targets

- Target
  
  7676c93819e3fbexeexeexeex.exe
- Size
  
  8.1MB
- MD5
  
  7676c93819e3fba566458677d29b3342
- SHA1
  
  b4ad74caf8c825aa0f083c3e588d050fcfc56ae5
- SHA256
  
  0ff18437b4b6872b2292d1e13280eb206050543e71d1e169132e4ed2ced0d778
- SHA512
  
  2a348d506c7eaec0380c3898ee50aecd91cd2e12a08e2d2ba5364ec8bbb5a5bcc47efddf322d3745423f427b800fc1995513461811f2f5f4a8b264c1c9629129
- SSDEEP
  
  196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1
Score

10^/10

mimikatz discovery xmrig evasion miner persistence upx
- Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- Suspicious use of NtCreateUserProcessOtherParentProcess
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Contacts a large (52502) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- XMRig Miner payload
  miner
- mimikatz is an open source tool to dump credentials on Windows
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates a Windows Service
  persistence
- Drops file in System32 directory
behavioral1 behavioral2