mimikatz | f8600c124c943f0d62e6db3f99ca6fdfe494c779ef5ec89f40e98f7af798d610

Sharing

Copy URL

Twitter E-mail

General

Target

f8600c124c943f0d62e6db3f99ca6fdfe494c779ef5ec89f40e98f7af798d610
Size

1.2MB
MD5

24437b2e3fb0ef3e47947279cc06f006
SHA1

11be8413ecd5a980a285c1783185bd45ca7da3d3
SHA256

f8600c124c943f0d62e6db3f99ca6fdfe494c779ef5ec89f40e98f7af798d610
SHA512

26a48f53cd655431d17fafd6efd79a690eaff0ece383f8697cf92c016bf0a7eb2b02289562227246b614170a537fec09703ebc9ed5dd3d4bd3894ed79dc19edf
SSDEEP

24576:2mmEUnvGYUlyTCuU/AhzHSX4U+rEtp+7a2fv55Un6W:q5ayTC1yHSG179fvEn

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Files

f8600c124c943f0d62e6db3f99ca6fdfe494c779ef5ec89f40e98f7af798d610
.exe windows:6 windows x86

262913b09a168e0e3f1001afd75631c4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2b:51:7c:eb:ac:82:0c:8c:10:3e:fd:17:22:7e:5b:59
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/03/2012, 00:00

Not After

05/06/2014, 23:59

Subject

CN=Beijing Compass Technology Development Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=VTN Support,O=Beijing Compass Technology Development Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:36:a1:48:e3:53:a0:89:8f:6e:9b:a6:fc:01:f6:fb:3b:ab:0f:8f
Signer

Actual PE Digest

14:36:a1:48:e3:53:a0:89:8f:6e:9b:a6:fc:01:f6:fb:3b:ab:0f:8f

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptReleaseContext
CryptGenKey
CryptGetProvParam
CryptGetHashParam
CryptImportKey
CryptSetKeyParam
CryptDestroyHash
CryptSetHashParam
CryptHashData
CryptCreateHash
CryptExportKey
CryptDecrypt
SystemFunction007
CryptDuplicateKey
CryptEncrypt
CryptAcquireContextW
CryptGetKeyParam
CryptAcquireContextA
CryptDestroyKey
GetLengthSid
CopySid
LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy
CreateWellKnownSid
CreateProcessAsUserW
CreateProcessWithLogonW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
SystemFunction032
ConvertSidToStringSidW
SystemFunction033
QueryServiceObjectSecurity
QueryServiceStatusEx
BuildSecurityDescriptorW
OpenServiceW
StartServiceW
FreeSid
ControlService
SetServiceObjectSecurity
DeleteService
AllocateAndInitializeSid
OpenSCManagerW
CloseServiceHandle
CreateServiceW
IsTextUnicode
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
DuplicateTokenEx
CheckTokenMembership
OpenProcessToken
CryptSetProvParam
CryptEnumProvidersW
ConvertStringSidToSidW
LsaFreeMemory
IsValidSid
GetSidSubAuthority
GetSidSubAuthorityCount
SetThreadToken
SystemFunction006
CryptEnumProviderTypesW
CryptGetUserKey
OpenEventLogW
ClearEventLogW
GetNumberOfEventLogRecords
CryptSignHashW
LsaRetrievePrivateData
LsaOpenSecret
LsaQueryTrustedDomainInfoByName
CryptDeriveKey
LsaQuerySecret
SystemFunction001
SystemFunction005
LsaSetSecret
LsaEnumerateTrustedDomainsEx
SystemFunction023
LookupPrivilegeValueW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
OpenThreadToken
LookupPrivilegeNameW
EqualSid
CredFree
CredEnumerateW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction027
SystemFunction026
SystemFunction041
CredUnmarshalCredentialW
CredIsMarshaledCredentialW
A_SHAFinal
A_SHAUpdate
A_SHAInit

cabinet

ord14
ord10
ord13
ord11

crypt32

CertGetNameStringW
CryptQueryObject
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertEnumSystemStore
CertAddEncodedCertificateToStore
CertFreeCertificateContext
CryptStringToBinaryA
CertCloseStore
PFXExportCertStoreEx
CertSetCertificateContextProperty
CertOpenStore
CryptStringToBinaryW
CryptUnprotectData
CryptBinaryToStringW
CryptBinaryToStringA
CryptAcquireCertificatePrivateKey
CryptExportPublicKeyInfo
CryptFindOIDInfo
CryptSignAndEncodeCertificate
CertNameToStrW
CryptEncodeObject
CertFindCertificateInStore
CertGetCertificateContextProperty
CryptProtectData
CryptDecodeObjectEx

cryptdll

CDGenerateRandomBits
MD5Init
MD5Update
MD5Final
CDLocateCSystem
CDLocateCheckSum

dnsapi

DnsQuery_A
DnsFree

fltlib

FilterFindNext
FilterFindFirst

mpr

WNetCancelConnection2W
WNetAddConnection2W

netapi32

DsGetDcNameW
NetApiBufferFree
NetWkstaUserEnum
NetShareEnum
NetStatisticsGet
NetRemoteTOD
NetServerGetInfo
DsEnumerateDomainTrustsW
NetSessionEnum
I_NetServerAuthenticate2
I_NetServerTrustPasswordsGet
I_NetServerReqChallenge

odbc32

ord31
ord24
ord43
ord9
ord141
ord111
ord13
ord75

ole32

CoUninitialize
CoSetProxyBlanket
CoTaskMemFree
CoInitializeEx
CoCreateInstance

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

rpcrt4

RpcMgmtEpEltInqDone
RpcMgmtEpEltInqBegin
RpcMgmtEpEltInqNextW
RpcBindingSetObject
I_RpcGetCurrentCallHandle
RpcBindingFree
MesIncrementalHandleReset
NdrMesTypeEncode2
NdrMesTypeDecode2
NdrMesTypeFree2
NdrMesTypeAlignSize2
RpcBindingVectorFree
RpcServerUseProtseqEpW
RpcServerUnregisterIfEx
RpcBindingToStringBindingW
UuidToStringW
RpcEpResolveBinding
RpcServerRegisterIf2
RpcMgmtWaitServerListen
RpcStringFreeW
RpcServerListen
RpcServerRegisterAuthInfoW
RpcEpUnregister
RpcEpRegisterW
RpcServerInqBindings
RpcMgmtStopServerListening
UuidCreate
NdrServerCall2
NdrClientCall2
RpcBindingSetAuthInfoW
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
MesDecodeIncrementalHandleCreate
MesHandleFree
RpcImpersonateClient
RpcRevertToSelf
MesEncodeIncrementalHandleCreate
I_RpcBindingInqSecurityContext

shlwapi

PathFindFileNameW
PathCombineW
PathIsDirectoryW
PathIsRelativeW
UrlUnescapeW
PathCanonicalizeW

samlib

SamGetGroupsForUser
SamGetMembersInAlias
SamGetMembersInGroup
SamEnumerateGroupsInDomain
SamGetAliasMembership
SamOpenAlias
SamRidToSid
SamEnumerateAliasesInDomain
SamOpenGroup
SamSetInformationUser
SamQueryInformationUser
SamFreeMemory
SamLookupDomainInSamServer
SamCloseHandle
SamConnect
SamLookupIdsInDomain
SamiChangePasswordUser
SamOpenUser
SamEnumerateDomainsInSamServer
SamOpenDomain
SamLookupNamesInDomain
SamEnumerateUsersInDomain

secur32

LsaConnectUntrusted
QueryContextAttributesW
FreeContextBuffer
LsaDeregisterLogonProcess
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer
DeleteSecurityContext
AcquireCredentialsHandleW
EnumerateSecurityPackagesW
FreeCredentialsHandle
LsaCallAuthenticationPackage
InitializeSecurityContextW

shell32

CommandLineToArgvW

user32

CreateWindowExW
IsCharAlphaNumericW
GetKeyboardLayout
GetClipboardSequenceNumber
GetClipboardData
TranslateMessage
EnumClipboardFormats
CloseClipboard
ChangeClipboardChain
DispatchMessageW
GetMessageW
DefWindowProcW
PostMessageW
DestroyWindow
SetClipboardViewer
OpenClipboard
SendMessageW
UnregisterClassW
RegisterClassExW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

hid

HidD_FreePreparsedData
HidD_GetPreparsedData
HidD_GetAttributes
HidD_GetFeature
HidD_SetFeature
HidP_GetCaps
HidD_GetHidGuid

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW

winscard

SCardReleaseContext
SCardListCardsW
SCardEstablishContext
SCardGetCardTypeProviderNameW
SCardListReadersW
SCardFreeMemory
SCardTransmit
SCardDisconnect
SCardConnectW
SCardControl
SCardGetAttrib

winsta

WinStationFreeMemory
WinStationEnumerateW
WinStationConnectW
WinStationCloseServer
WinStationQueryInformationW
WinStationOpenServerW

wldap32

ord310
ord208
ord73
ord13
ord36
ord157
ord97
ord122
ord139
ord12
ord69
ord96
ord223
ord113
ord140
ord14
ord88
ord203
ord224
ord147
ord27
ord26
ord127
ord133
ord167
ord309
ord304
ord301
ord54
ord145
ord77
ord142
ord41
ord79

msasn1

ASN1_CloseEncoder
ASN1BERDotVal2Eoid
ASN1_FreeEncoded
ASN1_CreateEncoder
ASN1_CloseModule
ASN1_CreateDecoder
ASN1_CreateModule
ASN1_CloseDecoder

ntdll

RtlAppendUnicodeStringToString
NtOpenDirectoryObject
RtlGetNtVersionNumbers
NtCompareTokens
RtlStringFromGUID
RtlGUIDFromString
RtlCreateUserThread
RtlAnsiStringToUnicodeString
NtQueryInformationProcess
NtQuerySystemInformation
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
NtQueryObject
RtlInitUnicodeString
RtlUpcaseUnicodeString
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
RtlEqualString
RtlGetCurrentPeb
RtlIpv6AddressToStringW
RtlEqualUnicodeString
RtlDowncaseUnicodeString
RtlFreeUnicodeString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
NtResumeProcess
NtQueryDirectoryObject
RtlAdjustPrivilege
NtTerminateProcess
NtSuspendProcess
NtSetSystemEnvironmentValueEx
NtQuerySystemEnvironmentValueEx
NtEnumerateSystemEnvironmentValuesEx
RtlIpv4AddressToStringW

kernel32

ReadFile
WriteConsoleW
ReadConsoleW
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetConsoleMode
LCMapStringW
CompareStringW
GetFileType
GetModuleHandleExW
GetModuleFileNameW
GetCommandLineW
GetCommandLineA
EncodePointer
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
WriteFile
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
LoadLibraryExA
SetFilePointerEx
GetProcessId
GetComputerNameW
ProcessIdToSessionId
GetCurrentThread
IsWow64Process
SetConsoleCursorPosition
SetCurrentDirectoryW
FillConsoleOutputCharacterW
GetTimeZoneInformation
GetSystemDirectoryW
GetStdHandle
GetConsoleScreenBufferInfo
SetEvent
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreatePipe
SetHandleInformation
GlobalSize
SetFileAttributesW
SetConsoleTitleW
ExitProcess
RaiseException
ExitThread
SetConsoleCtrlHandler
GetTickCount
QueryPerformanceCounter
FormatMessageA
GetSystemTime
GetProcessHeap
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
GetSystemInfo
HeapReAlloc
DeleteFileW
WaitForSingleObjectEx
LoadLibraryA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
MultiByteToWideChar
HeapSize
HeapValidate
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
GetDateFormatW
GetSystemTimeAsFileTime
WideCharToMultiByte
SystemTimeToFileTime
GetTimeFormatW
lstrlenA
ClearCommError
PurgeComm
CreateRemoteThread
WaitForSingleObject
CreateProcessW
SetConsoleOutputCP
GetConsoleOutputCP
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
VirtualQueryEx
VirtualQuery
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
VirtualFree
SetLastError
VirtualProtect
WriteProcessMemory
GetComputerNameExW
DeviceIoControl
OpenProcess
DuplicateHandle
GetCurrentProcess
FlushFileBuffers
GetCurrentDirectoryW
GetFileAttributesW
FindClose
ExpandEnvironmentStringsW
DecodePointer
FindNextFileW
GetFileSizeEx
FindFirstFileW
lstrlenW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
FileTimeToDosDateTime
GetTempFileNameA
FileTimeToLocalFileTime
DeleteFileA
CreateFileA
GetTempPathA
GetFileInformationByHandle
GetCurrentDirectoryA
SetFilePointer
LocalFree
CreateThread
CloseHandle
TerminateThread
GetLastError
Sleep
CreateFileW
LocalAlloc
FileTimeToSystemTime

Sections

.text
Size: 771KB - Virtual size: 771KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 395KB - Virtual size: 394KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

262913b09a168e0e3f1001afd75631c4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

2b:51:7c:eb:ac:82:0c:8c:10:3e:fd:17:22:7e:5b:59Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

14:36:a1:48:e3:53:a0:89:8f:6e:9b:a6:fc:01:f6:fb:3b:ab:0f:8fSigner

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

cabinet

crypt32

cryptdll

dnsapi

fltlib

mpr

netapi32

odbc32

ole32

oleaut32

rpcrt4

shlwapi

samlib

secur32

shell32

user32

userenv

version

hid

setupapi

winscard

winsta

wldap32

msasn1

ntdll

kernel32

Sections

.text Size: 771KB - Virtual size: 771KB

.rdata Size: 395KB - Virtual size: 394KB

.data Size: 15KB - Virtual size: 19KB

.reloc Size: 36KB - Virtual size: 35KB

.rsrc Size: 1KB - Virtual size: 4KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

2b:51:7c:eb:ac:82:0c:8c:10:3e:fd:17:22:7e:5b:59
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

14:36:a1:48:e3:53:a0:89:8f:6e:9b:a6:fc:01:f6:fb:3b:ab:0f:8f
Signer

.text
Size: 771KB - Virtual size: 771KB

.rdata
Size: 395KB - Virtual size: 394KB

.data
Size: 15KB - Virtual size: 19KB

.reloc
Size: 36KB - Virtual size: 35KB

.rsrc
Size: 1KB - Virtual size: 4KB