mimikatz | 56bde69ef894d1d3799593d6dac80a7adec2dd576dcf6f426ea307388538bb4e

Sharing

Copy URL Twitter E-mail

General

Target

56bde69ef894d1d3799593d6dac80a7adec2dd576dcf6f426ea307388538bb4e
Size

2.1MB
MD5

5b7b717f414e6eb2da995c2ae397ce88
SHA1

d984ddfa702fc4cdb94916f3af526ceef75be34a
SHA256

56bde69ef894d1d3799593d6dac80a7adec2dd576dcf6f426ea307388538bb4e
SHA512

696721d6989b406ace8f18422f35adff92da95ffe84e1f16dfb04232d9c498bb1548aeded13155228a406630d19f206b9242e43bf0a908f84fb0fa18065ca824
SSDEEP

24576:1QvDAgcsPDW8IklA9fpgC7S8Dm/4BrfMU0tWKVrv+kK0OP124TRN:13sP1lSA/45JnKVqk1ET

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56bde69ef894d1d3799593d6dac80a7adec2dd576dcf6f426ea307388538bb4e

Files

56bde69ef894d1d3799593d6dac80a7adec2dd576dcf6f426ea307388538bb4e
.exe windows:6 windows x64

7b14b31282ef91dd75b5e7a0f6d2b7d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CryptReleaseContext
CryptGenKey
CryptGetProvParam
CryptGetHashParam
CryptImportKey
CryptSetKeyParam
CryptDestroyHash
CryptSetHashParam
CryptHashData
CryptCreateHash
CryptExportKey
CryptDecrypt
SystemFunction007
CryptDuplicateKey
CryptEncrypt
CryptAcquireContextW
CryptGetKeyParam
CryptAcquireContextA
CryptDestroyKey
GetLengthSid
CopySid
LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy
CreateWellKnownSid
CreateProcessAsUserW
CreateProcessWithLogonW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
SystemFunction032
ConvertSidToStringSidW
SystemFunction033
QueryServiceObjectSecurity
QueryServiceStatusEx
BuildSecurityDescriptorW
OpenServiceW
StartServiceW
FreeSid
ControlService
SetServiceObjectSecurity
DeleteService
AllocateAndInitializeSid
OpenSCManagerW
CloseServiceHandle
CreateServiceW
IsTextUnicode
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
DuplicateTokenEx
CheckTokenMembership
OpenProcessToken
CryptSetProvParam
CryptEnumProvidersW
ConvertStringSidToSidW
LsaFreeMemory
IsValidSid
GetSidSubAuthority
GetSidSubAuthorityCount
SetThreadToken
SystemFunction006
CryptEnumProviderTypesW
CryptGetUserKey
OpenEventLogW
ClearEventLogW
GetNumberOfEventLogRecords
CryptSignHashW
LsaRetrievePrivateData
LsaOpenSecret
LsaQueryTrustedDomainInfoByName
CryptDeriveKey
LsaQuerySecret
SystemFunction001
SystemFunction005
LsaSetSecret
LsaEnumerateTrustedDomainsEx
SystemFunction023
LookupPrivilegeValueW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
OpenThreadToken
LookupPrivilegeNameW
EqualSid
CredFree
CredEnumerateW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction027
SystemFunction026
SystemFunction041
CredUnmarshalCredentialW
CredIsMarshaledCredentialW
A_SHAInit
A_SHAFinal
A_SHAUpdate

bcrypt

BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptDeriveKeyPBKDF2
BCryptDecrypt
BCryptSetProperty
BCryptExportKey
BCryptImportKeyPair
BCryptFreeBuffer
BCryptEnumRegisteredProviders
BCryptEncrypt
BCryptKeyDerivation
BCryptGenerateSymmetricKey

cabinet

ord10
ord13
ord14
ord11

crypt32

CryptDecodeObjectEx
CryptProtectData
CertGetCertificateContextProperty
CertFindCertificateInStore
CryptEncodeObject
CertNameToStrW
CryptSignAndEncodeCertificate
CryptFindOIDInfo
CryptExportPublicKeyInfo
CryptAcquireCertificatePrivateKey
CryptBinaryToStringA
CryptBinaryToStringW
CryptUnprotectData
CryptStringToBinaryW
CertOpenStore
CertGetNameStringW
CryptQueryObject
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertSetCertificateContextProperty
PFXExportCertStoreEx
CertCloseStore
CertEnumSystemStore
CryptStringToBinaryA
CertAddEncodedCertificateToStore
CertFreeCertificateContext

cryptdll

MD5Update
MD5Final
CDLocateCSystem
MD5Init
CDGenerateRandomBits
CDLocateCheckSum

dnsapi

DnsQuery_A
DnsFree

fltlib

FilterFindFirst
FilterFindNext

mpr

WNetCancelConnection2W
WNetAddConnection2W

ncrypt

NCryptOpenStorageProvider
NCryptGetProperty
NCryptFreeObject
NCryptSetProperty
NCryptOpenKey
NCryptDecrypt
NCryptExportKey
NCryptFreeBuffer
NCryptEnumKeys
NCryptFinalizeKey
NCryptSignHash
NCryptImportKey

netapi32

NetSessionEnum
NetRemoteTOD
NetServerGetInfo
DsEnumerateDomainTrustsW
DsGetDcNameW
NetApiBufferFree
NetWkstaUserEnum
NetShareEnum
NetStatisticsGet
I_NetServerTrustPasswordsGet
I_NetServerAuthenticate2
I_NetServerReqChallenge

odbc32

ord43
ord111
ord9
ord13
ord31
ord24
ord75
ord141

ole32

CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemFree

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

rpcrt4

RpcMgmtEpEltInqNextW
I_RpcGetCurrentCallHandle
RpcEpRegisterW
RpcMgmtEpEltInqDone
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcStringFreeW
MesHandleFree
RpcImpersonateClient
RpcRevertToSelf
MesEncodeIncrementalHandleCreate
MesDecodeIncrementalHandleCreate
RpcBindingFree
MesIncrementalHandleReset
NdrMesTypeEncode2
NdrMesTypeDecode2
NdrMesTypeFree2
NdrMesTypeAlignSize2
RpcBindingVectorFree
RpcServerUseProtseqEpW
RpcServerUnregisterIfEx
RpcBindingToStringBindingW
UuidToStringW
RpcServerRegisterIf2
RpcMgmtWaitServerListen
RpcServerListen
RpcServerRegisterAuthInfoW
RpcEpUnregister
RpcMgmtEpEltInqBegin
RpcServerInqBindings
RpcMgmtStopServerListening
I_RpcBindingInqSecurityContext
NdrClientCall2
NdrServerCall2
UuidCreate
RpcEpResolveBinding
RpcBindingSetObject
RpcBindingSetAuthInfoW

shlwapi

PathFindFileNameW
PathCanonicalizeW
PathCombineW
PathIsDirectoryW
PathIsRelativeW
UrlUnescapeW

samlib

SamOpenGroup
SamSetInformationUser
SamEnumerateAliasesInDomain
SamOpenDomain
SamQueryInformationUser
SamGetGroupsForUser
SamGetMembersInAlias
SamGetMembersInGroup
SamEnumerateGroupsInDomain
SamGetAliasMembership
SamOpenAlias
SamEnumerateUsersInDomain
SamLookupNamesInDomain
SamRidToSid
SamEnumerateDomainsInSamServer
SamOpenUser
SamiChangePasswordUser
SamLookupIdsInDomain
SamConnect
SamCloseHandle
SamLookupDomainInSamServer
SamFreeMemory

secur32

LsaDeregisterLogonProcess
LsaConnectUntrusted
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer
DeleteSecurityContext
AcquireCredentialsHandleW
QueryContextAttributesW
EnumerateSecurityPackagesW
FreeCredentialsHandle
InitializeSecurityContextW
FreeContextBuffer
LsaCallAuthenticationPackage

shell32

CommandLineToArgvW

user32

GetUserObjectInformationW
GetMessageW
DefWindowProcW
PostMessageW
DestroyWindow
SetClipboardViewer
CreateWindowExW
SendMessageW
UnregisterClassW
RegisterClassExW
OpenClipboard
DispatchMessageW
ChangeClipboardChain
CloseClipboard
EnumClipboardFormats
TranslateMessage
GetClipboardData
GetClipboardSequenceNumber
GetKeyboardLayout
IsCharAlphaNumericW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

hid

HidD_FreePreparsedData
HidD_GetPreparsedData
HidP_GetCaps
HidD_GetAttributes
HidD_GetFeature
HidD_SetFeature
HidD_GetHidGuid

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW

winscard

SCardGetAttrib
SCardEstablishContext
SCardReleaseContext
SCardListCardsW
SCardGetCardTypeProviderNameW
SCardFreeMemory
SCardControl
SCardConnectW
SCardDisconnect
SCardTransmit
SCardListReadersW

winsta

WinStationConnectW
WinStationFreeMemory
WinStationCloseServer
WinStationQueryInformationW
WinStationOpenServerW
WinStationEnumerateW

wldap32

ord310
ord73
ord13
ord36
ord79
ord41
ord142
ord208
ord145
ord54
ord301
ord304
ord309
ord167
ord127
ord26
ord27
ord147
ord133
ord157
ord224
ord203
ord88
ord14
ord140
ord77
ord223
ord96
ord69
ord12
ord139
ord122
ord97
ord113

msasn1

ASN1_CloseEncoder
ASN1_FreeEncoded
ASN1_CreateEncoder
ASN1_CloseModule
ASN1Free
ASN1_CreateDecoder
ASN1_CloseDecoder
ASN1_CreateModule
ASN1BERDotVal2Eoid
ASN1BEREoid2DotVal

ntdll

RtlFreeAnsiString
NtSetSystemEnvironmentValueEx
RtlFreeUnicodeString
RtlEqualUnicodeString
RtlUnicodeStringToAnsiString
NtSuspendProcess
NtTerminateProcess
NtQuerySystemEnvironmentValueEx
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlDowncaseUnicodeString
NtEnumerateSystemEnvironmentValuesEx
RtlAdjustPrivilege
NtQueryDirectoryObject
NtOpenDirectoryObject
NtResumeProcess
RtlUpcaseUnicodeStringToOemString
RtlFreeOemString
RtlAnsiStringToUnicodeString
RtlUpcaseUnicodeString
RtlAppendUnicodeStringToString
RtlEqualString
RtlGetNtVersionNumbers
NtCompareTokens
RtlStringFromGUID
RtlGUIDFromString
RtlCreateUserThread
RtlGetCurrentPeb
NtQueryInformationProcess
NtQuerySystemInformation
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
NtQueryObject
RtlInitUnicodeString

kernel32

CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
GetModuleHandleExW
TerminateProcess
EnumSystemLocalesW
GetConsoleMode
SetStdHandle
FindFirstFileExW
IsValidCodePage
GetACP
GetModuleFileNameW
GetCommandLineW
GetCommandLineA
GetOEMCP
EncodePointer
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetCurrentThreadId
SetFilePointerEx
GetProcessId
GetComputerNameW
IsWow64Process
ProcessIdToSessionId
GetCurrentThread
SetConsoleCursorPosition
SetCurrentDirectoryW
FillConsoleOutputCharacterW
GetTimeZoneInformation
GetSystemDirectoryW
GetStdHandle
GetConsoleScreenBufferInfo
SetEvent
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreatePipe
SetHandleInformation
GlobalSize
SetFileAttributesW
SetConsoleTitleW
ExitProcess
RaiseException
ExitThread
SetConsoleCtrlHandler
GetTickCount
QueryPerformanceCounter
FormatMessageA
GetSystemTime
GetProcessHeap
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
GetSystemInfo
HeapReAlloc
DeleteFileW
WaitForSingleObjectEx
LoadLibraryA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
MultiByteToWideChar
HeapSize
HeapValidate
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
GetDateFormatW
GetSystemTimeAsFileTime
WideCharToMultiByte
SystemTimeToFileTime
GetTimeFormatW
lstrlenA
ClearCommError
PurgeComm
CreateRemoteThread
WaitForSingleObject
CreateProcessW
ConnectNamedPipe
WaitNamedPipeW
GetNamedPipeInfo
DisconnectNamedPipe
CreateNamedPipeW
SetNamedPipeHandleState
SetConsoleOutputCP
GetConsoleOutputCP
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
VirtualQueryEx
VirtualQuery
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
VirtualFree
SetLastError
VirtualProtect
WriteProcessMemory
GetComputerNameExW
DeviceIoControl
OpenProcess
DuplicateHandle
GetCurrentProcess
FlushFileBuffers
GetCurrentDirectoryW
GetFileAttributesW
FindClose
ExpandEnvironmentStringsW
FindNextFileW
GetFileSizeEx
FindFirstFileW
lstrlenW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
FileTimeToDosDateTime
GetTempFileNameA
FileTimeToLocalFileTime
DeleteFileA
CreateFileA
GetTempPathA
GetFileInformationByHandle
GetCurrentDirectoryA
SetFilePointer
LocalFree
CreateThread
CloseHandle
TerminateThread
GetLastError
RtlUnwind
Sleep
CreateFileW
LocalAlloc
WriteFile
ReadFile
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
ReadConsoleW
WriteConsoleW
RtlPcToFileHeader
FileTimeToSystemTime

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b14b31282ef91dd75b5e7a0f6d2b7d7

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

cabinet

crypt32

cryptdll

dnsapi

fltlib

mpr

ncrypt

netapi32

odbc32

ole32

oleaut32

rpcrt4

shlwapi

samlib

secur32

shell32

user32

userenv

version

hid

setupapi

winscard

winsta

wldap32

msasn1

ntdll

kernel32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 333KB - Virtual size: 333KB

.data Size: 27KB - Virtual size: 35KB

.pdata Size: 59KB - Virtual size: 58KB

.gxfg Size: 49KB - Virtual size: 48KB

.gehcont Size: 512B - Virtual size: 32B

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 333KB - Virtual size: 333KB

.data
Size: 27KB - Virtual size: 35KB

.pdata
Size: 59KB - Virtual size: 58KB

.gxfg
Size: 49KB - Virtual size: 48KB

.gehcont
Size: 512B - Virtual size: 32B

.reloc
Size: 8KB - Virtual size: 8KB