mimikatz | 31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc

Sharing

Copy URL Twitter E-mail

General

Target
31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc
Size 1.2MB
Sample240410-h82fesff77
SHA256 31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc
MD5 a3cb3b02a683275f7e0a0f8a9a5c9e07
SHA1 d241df7b9d2ec0b8194751cd5ce153e27cc40fa4
SHA512 95a99fd1686bd5b01d3eb5b055d3cab900e6480d4e2360595b64d57c80e74daa4c14753fa2e0e224ea5c72735af3339fb72f7d9455f4feeb3e237e6c20866d96
SSDEEP 24576:XOzE5EJgB1alEruZrnnDGgMsnPjKesPbqJgUe8MAm4rCNG/:XOSwrDzLj5O2JgUe8M0n/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

File Explorer

31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc

.exe 1.2MB

31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc

IMPHASH dbdea7b557f0e6b5d9e18abe9ce5220a
SHA256 31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc
MD5 a3cb3b02a683275f7e0a0f8a9a5c9e07
SHA1 d241df7b9d2ec0b8194751cd5ce153e27cc40fa4
SHA512 95a99fd1686bd5b01d3eb5b055d3cab900e6480d4e2360595b64d57c80e74daa4c14753fa2e0e224ea5c72735af3339fb72f7d9455f4feeb3e237e6c20866d96
SSDEEP 24576:XOzE5EJgB1alEruZrnnDGgMsnPjKesPbqJgUe8MAm4rCNG/:XOSwrDzLj5O2JgUe8M0n/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

mimikatz is an open source tool to dump credentials on Windows

Digest

07:ed:10:5c:3d:8d:13:5e:be:fc:ff:4a:04:ea:68:00:ce:d7:08:af:50:72:7c:90:b3:1d:a2:26:67:73:6a:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Chains

Sep 18, 2020

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Digest

21:5a:25:8d:3c:23:ac:b5:c2:e2:dd:ef:14:b9:6f:18:ba:86:66:22

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Chains

Sep 18, 2020

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 29, 2015 - Jun 9, 2027

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Serial Number

10:a9:2b:2a:c8:aa:84:76:b6:c7:23:2e:c0:a9:e6:fa

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 5, 2019 - Dec 4, 2020

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 8, 2016 - May 30, 2027

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 29, 2015 - Jun 9, 2027

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Serial Number

10:a9:2b:2a:c8:aa:84:76:b6:c7:23:2e:c0:a9:e6:fa

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 5, 2019 - Dec 4, 2020

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 8, 2016 - May 30, 2027

Minor OS version

Major OS version

Entry point

801516

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptSetHashParam CryptGetHashParam CryptExportKey CryptAcquireContextW CryptSetKeyParam CryptGetKeyParam CryptReleaseContext CryptDuplicateKey CryptAcquireContextA CryptGetProvParam CryptImportKey SystemFunction007 CryptEncrypt CryptCreateHash CryptGenKey CryptDestroyKey CryptDecrypt CryptDestroyHash CryptHashData CopySid GetLengthSid LsaQueryInformationPolicy LsaOpenPolicy LsaClose CreateWellKnownSid CreateProcessWithLogonW CreateProcessAsUserW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegSetValueExW SystemFunction032 ConvertSidToStringSidW CreateServiceW CloseServiceHandle DeleteService OpenSCManagerW SetServiceObjectSecurity OpenServiceW BuildSecurityDescriptorW QueryServiceObjectSecurity StartServiceW AllocateAndInitializeSid QueryServiceStatusEx FreeSid ControlService IsTextUnicode OpenProcessToken GetTokenInformation LookupAccountNameW LookupAccountSidW DuplicateTokenEx CheckTokenMembership CryptSetProvParam CryptEnumProvidersW ConvertStringSidToSidW LsaFreeMemory GetSidSubAuthority GetSidSubAuthorityCount IsValidSid SetThreadToken CryptEnumProviderTypesW SystemFunction006 CryptGetUserKey OpenEventLogW GetNumberOfEventLogRecords ClearEventLogW SystemFunction001 CryptDeriveKey SystemFunction005 LsaQueryTrustedDomainInfoByName CryptSignHashW LsaSetSecret LsaOpenSecret LsaQuerySecret SystemFunction013 LsaRetrievePrivateData LsaEnumerateTrustedDomainsEx LookupPrivilegeValueW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW LookupPrivilegeNameW OpenThreadToken EqualSid CredFree CredEnumerateW SystemFunction025 ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction024 CredIsMarshaledCredentialW CredUnmarshalCredentialW A_SHAFinal A_SHAInit A_SHAUpdate

cabinet

ord11 ord14 ord10 ord13

crypt32

CertNameToStrW CertEnumSystemStore CertEnumCertificatesInStore CertAddCertificateContextToStore CryptDecodeObjectEx CertAddEncodedCertificateToStore CertOpenStore CertFreeCertificateContext CertCloseStore CertSetCertificateContextProperty PFXExportCertStoreEx CryptUnprotectData CryptBinaryToStringW CryptStringToBinaryA CryptBinaryToStringA CryptStringToBinaryW CryptExportPublicKeyInfo CryptFindOIDInfo CryptAcquireCertificatePrivateKey CertGetNameStringW CertFindCertificateInStore CertGetCertificateContextProperty CryptSignAndEncodeCertificate CryptEncodeObject CryptProtectData CryptQueryObject

cryptdll

MD5Update MD5Final CDGenerateRandomBits CDLocateCSystem MD5Init CDLocateCheckSum

dnsapi

DnsFree DnsQuery_A

fltlib

FilterFindFirst FilterFindNext

netapi32

NetServerGetInfo NetStatisticsGet NetShareEnum DsEnumerateDomainTrustsW DsGetDcNameW NetApiBufferFree NetRemoteTOD NetSessionEnum NetWkstaUserEnum I_NetServerAuthenticate2 I_NetServerTrustPasswordsGet I_NetServerReqChallenge

ole32

CoTaskMemFree CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantInit SysFreeString SysAllocString

rpcrt4

RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin I_RpcGetCurrentCallHandle NdrClientCall2 RpcMgmtEpEltInqDone RpcBindingFromStringBindingW RpcStringBindingComposeW MesEncodeIncrementalHandleCreate RpcBindingSetAuthInfoExW RpcBindingInqAuthClientW RpcBindingSetOption RpcImpersonateClient RpcBindingFree RpcStringFreeW RpcRevertToSelf MesDecodeIncrementalHandleCreate MesHandleFree MesIncrementalHandleReset NdrMesTypeDecode2 NdrMesTypeAlignSize2 NdrMesTypeFree2 NdrMesTypeEncode2 RpcServerUnregisterIfEx I_RpcBindingInqSecurityContext RpcServerInqBindings RpcServerListen RpcMgmtWaitServerListen RpcEpRegisterW RpcMgmtStopServerListening RpcBindingToStringBindingW RpcServerRegisterIf2 RpcServerRegisterAuthInfoW RpcBindingVectorFree UuidToStringW RpcServerUseProtseqEpW RpcEpUnregister NdrServerCall2 RpcBindingSetAuthInfoW UuidCreate RpcEpResolveBinding

shlwapi

PathIsDirectoryW PathCanonicalizeW PathCombineW PathFindFileNameW PathIsRelativeW

samlib

SamiChangePasswordUser SamSetInformationUser SamConnect SamEnumerateGroupsInDomain SamOpenDomain SamGetGroupsForUser SamGetMembersInGroup SamRidToSid SamGetMembersInAlias SamEnumerateAliasesInDomain SamGetAliasMembership SamQueryInformationUser SamCloseHandle SamEnumerateDomainsInSamServer SamFreeMemory SamEnumerateUsersInDomain SamOpenUser SamLookupDomainInSamServer SamLookupNamesInDomain SamLookupIdsInDomain SamOpenGroup SamOpenAlias

secur32

QueryContextAttributesW LsaDeregisterLogonProcess FreeContextBuffer LsaFreeReturnBuffer LsaCallAuthenticationPackage LsaConnectUntrusted DeleteSecurityContext FreeCredentialsHandle EnumerateSecurityPackagesW AcquireCredentialsHandleW InitializeSecurityContextW LsaLookupAuthenticationPackage

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW GetKeyboardLayout DispatchMessageW DefWindowProcW SetClipboardViewer SendMessageW GetClipboardSequenceNumber OpenClipboard CreateWindowExW ChangeClipboardChain GetClipboardData RegisterClassExW TranslateMessage EnumClipboardFormats PostMessageW UnregisterClassW GetMessageW CloseClipboard DestroyWindow

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

hid

HidD_GetFeature HidD_GetPreparsedData HidD_GetHidGuid HidD_GetAttributes HidD_FreePreparsedData HidP_GetCaps HidD_SetFeature

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

winscard

SCardControl SCardTransmit SCardDisconnect SCardGetAttrib SCardEstablishContext SCardFreeMemory SCardListReadersW SCardReleaseContext SCardGetCardTypeProviderNameW SCardListCardsW SCardConnectW

winsta

WinStationCloseServer WinStationOpenServerW WinStationFreeMemory WinStationConnectW WinStationQueryInformationW WinStationEnumerateW

wldap32

ord122 ord14 ord88 ord157 ord133 ord27 ord147 ord167 ord26 ord127 ord224 ord113 ord309 ord54 ord142 ord77 ord13 ord208 ord145 ord36 ord79 ord41 ord73 ord310 ord203 ord69 ord139 ord97 ord223 ord304 ord12 ord96 ord301 ord140

msasn1

ASN1_CreateModule ASN1BERDotVal2Eoid ASN1_CloseEncoder ASN1_CreateDecoder ASN1_FreeEncoded ASN1_CloseModule ASN1_CreateEncoder ASN1_CloseDecoder

ntdll

RtlUnicodeStringToAnsiString RtlFreeAnsiString RtlDowncaseUnicodeString RtlFreeUnicodeString RtlInitUnicodeString RtlEqualUnicodeString NtQueryObject RtlCompressBuffer RtlGetCompressionWorkSpaceSize NtQuerySystemInformation RtlGetCurrentPeb NtQueryInformationProcess RtlCreateUserThread RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlEqualString RtlUpcaseUnicodeString RtlAppendUnicodeStringToString RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtResumeProcess RtlAdjustPrivilege NtSuspendProcess NtTerminateProcess NtQuerySystemEnvironmentValueEx NtSetSystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW RtlIpv6AddressToStringW

kernel32

GetSystemTimeAsFileTime SystemTimeToFileTime lstrlenA GetDateFormatW PurgeComm ClearCommError CreateRemoteThread WaitForSingleObject SetLastError RtlVirtualUnwind SetFilePointerEx GetProcessId GetComputerNameW CreateProcessW SetConsoleOutputCP GetConsoleOutputCP CreateFileMappingW UnmapViewOfFile MapViewOfFile WriteProcessMemory VirtualAllocEx VirtualProtectEx VirtualAlloc ReadProcessMemory VirtualFreeEx VirtualQueryEx VirtualFree VirtualQuery GetComputerNameExW DeviceIoControl DuplicateHandle OpenProcess GetCurrentProcess ExpandEnvironmentStringsW FindNextFileW FindClose GetCurrentDirectoryW GetFileSizeEx FlushFileBuffers GetFileAttributesW FindFirstFileW lstrlenW GetProcAddress LoadLibraryW GetModuleHandleW FreeLibrary DeleteFileA GetTempPathA GetFileInformationByHandle FileTimeToLocalFileTime GetCurrentDirectoryA GetTempFileNameA SetFilePointer CreateFileA FileTimeToDosDateTime CreateThread LocalFree CloseHandle WideCharToMultiByte GetLastError CreateFileW ReadFile TerminateThread WriteFile FileTimeToSystemTime Sleep VirtualProtect GetFullPathNameW GetFullPathNameA HeapReAlloc GetFileSize CreateMutexW HeapCompact SetEndOfFile HeapAlloc QueryPerformanceCounter HeapFree UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount GetTimeFormatW UnlockFileEx GetProcessHeap FormatMessageA FormatMessageW GetVersionExW HeapDestroy GetFileAttributesA HeapCreate HeapValidate MultiByteToWideChar GetTempPathW HeapSize LockFileEx GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW OutputDebugStringA GetVersionExA DeleteFileW GetCurrentProcessId GetSystemTime AreFileApisANSI ExitProcess ExitThread RaiseException SetConsoleCtrlHandler SetConsoleTitleW SetFileAttributesW GlobalSize SetHandleInformation CreatePipe InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetEvent CreateEventW GetCurrentThreadId SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlCaptureContext LocalAlloc RtlLookupFunctionEntry GetSystemDirectoryW SetConsoleCursorPosition GetTimeZoneInformation GetStdHandle FillConsoleOutputCharacterW ProcessIdToSessionId GetCurrentThread SetCurrentDirectoryW GetConsoleScreenBufferInfo

msvcrt

isspace isdigit calloc mbtowc _lseeki64 _write isleadbyte isxdigit localeconv _snprintf _itoa wctomb ferror iswctype wcstombs _isatty ungetc ?terminate@@YAXXZ __badioinfo __pioinfo _read log __mb_cur_max _iob __set_app_type _fmode _commode __setusermatherr _errno free _wcsdup _vsnprintf strrchr _wcsicmp vfwprintf _vscwprintf fflush _wfopen wprintf _fileno memcmp vwprintf _setmode fclose _stricmp wcsrchr wcschr strtoul _wcsnicmp wcsstr _vscprintf memmove strncmp malloc _msize strcspn realloc fgetws wcstoul strchr wcstol wcsncmp towupper _wpgmptr strstr _wcstoui64 getchar memcpy memset __C_specific_handler __wgetmainargs _XcptFilter _exit _cexit exit _initterm _amsg_exit

generic

count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=63, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,

count=2, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=2, id=132, productName=VS2008 build 21022, version=21022,

count=47, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=647, id=1, productName=Unmarked objects,

count=1, id=126, version=50727,

count=105, id=137, version=30729,

count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,