mimikatz

General

Target

2024-01-18_b0f72fc8e7c1091f0ae670a75ffb6ce6_hacktools_icedid_mimikatz
Size

10.4MB
Sample

240118-28d5nsehfn
MD5

b0f72fc8e7c1091f0ae670a75ffb6ce6
SHA1

7f5465fe5ce274cc74274e95ce7e7fadb6d779fe
SHA256

fcd076fd18c0fa50ed5fd3ffb370a95e83aab3db003f060520926feff7a29178
SHA512

5bfaf46f3ed9473fa7380fb21f4dd4a05d6469f56327a061556af51c89d9fc5f79f2b865cce7efd23eaa3ceacff097cc0e240fd1e0045c50802216d91abfb335
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

Malware Config

Targets

- Target
  
  2024-01-18_b0f72fc8e7c1091f0ae670a75ffb6ce6_hacktools_icedid_mimikatz
- Size
  
  10.4MB
- MD5
  
  b0f72fc8e7c1091f0ae670a75ffb6ce6
- SHA1
  
  7f5465fe5ce274cc74274e95ce7e7fadb6d779fe
- SHA256
  
  fcd076fd18c0fa50ed5fd3ffb370a95e83aab3db003f060520926feff7a29178
- SHA512
  
  5bfaf46f3ed9473fa7380fb21f4dd4a05d6469f56327a061556af51c89d9fc5f79f2b865cce7efd23eaa3ceacff097cc0e240fd1e0045c50802216d91abfb335
- SSDEEP
  
  196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1
Score

10^/10

mimikatz discovery xmrig evasion miner persistence upx
- Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- Suspicious use of NtCreateUserProcessOtherParentProcess
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- mimikatz is an open source tool to dump credentials on Windows
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Creates a Windows Service
  persistence
- Drops file in System32 directory
behavioral1 behavioral2