Behavioral task
behavioral1
Sample
8e48a53d19a45ca6a39ac0c7cda84500_hacktools_icedid_mimikatz_JC.exe
Resource
win7-20230712-en
General
-
Target
8e48a53d19a45ca6a39ac0c7cda84500_hacktools_icedid_mimikatz_JC.exe
-
Size
9.4MB
-
MD5
8e48a53d19a45ca6a39ac0c7cda84500
-
SHA1
21085ce8c1a0b26c4660220ebb70c448c937c05c
-
SHA256
029cce68cd446d0b0ad8a456e4c78d66e4a7338ddba7d3943ced21baa82068ae
-
SHA512
fb6ae7ca31621a1e81032d9b36e5efcf90f8a608aec410a01930c26e97f599af1d26cf37a6f3e5b18d1aaad5c69229383610c11b2d0ba94400c9281cab2398c6
-
SSDEEP
196608:7po1mknGzwHdOgEPHd9BbX/nivPlTXTYe:agjz0E57/iv1
Malware Config
Signatures
-
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule sample mimikatz -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e48a53d19a45ca6a39ac0c7cda84500_hacktools_icedid_mimikatz_JC.exe -
NSIS installer 1 IoCs
resource yara_rule sample nsis_installer_2
Files
-
8e48a53d19a45ca6a39ac0c7cda84500_hacktools_icedid_mimikatz_JC.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 740KB - Virtual size: 738KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ