mimikatz | 732bfac9a3a9fbddc369eb75c25f69e8336dcdf855c7bc89d717d9b86dc297cf

Sharing

Copy URL Twitter E-mail

General

Target
732bfac9a3a9fbddc369eb75c25f69e8336dcdf855c7bc89d717d9b86dc297cf
Size 980KB
Sample240410-n13leaef86
SHA256 732bfac9a3a9fbddc369eb75c25f69e8336dcdf855c7bc89d717d9b86dc297cf
MD5 cfbac2be66ebfe0a9324d188199c0de2
SHA1 540a75eb8e47958567b0f1e46e1a1da8bb9ccda7
SHA512 cb1cc5e5991e6d2a3423e3dd051437032c83a5da0ce5f3ac2505be8a93efdd606b8efd042f787313bb896c976f6140d6937987f1b3f5bf5a981477abf4300bd8
SSDEEP 24576:ayekvVmlphavAPSvIaw4UFb2lWemFHM3r:JeKGphe6CIaw4UMlWVFHMb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

File Explorer

732bfac9a3a9fbddc369eb75c25f69e8336dcdf855c7bc89d717d9b86dc297cf

.exe 980KB

732bfac9a3a9fbddc369eb75c25f69e8336dcdf855c7bc89d717d9b86dc297cf

IMPHASH fcf758bdc8e91a946e344d06fd667418
SHA256 732bfac9a3a9fbddc369eb75c25f69e8336dcdf855c7bc89d717d9b86dc297cf
MD5 cfbac2be66ebfe0a9324d188199c0de2
SHA1 540a75eb8e47958567b0f1e46e1a1da8bb9ccda7
SHA512 cb1cc5e5991e6d2a3423e3dd051437032c83a5da0ce5f3ac2505be8a93efdd606b8efd042f787313bb896c976f6140d6937987f1b3f5bf5a981477abf4300bd8
SSDEEP 24576:ayekvVmlphavAPSvIaw4UFb2lWemFHM3r:JeKGphe6CIaw4UMlWVFHMb
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

mimikatz is an open source tool to dump credentials on Windows

Digest

e6:15:f6:1c:95:35:bd:14:38:75:c4:b4:f0:2a:4f:ba:de:56:63:ed:eb:db:2a:0c:aa:f4:3a:4b:9d:ce:7f:63

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Chains

Apr 14, 2019

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Digest

5d:2d:ae:ff:00:96:ec:d3:ef:bb:df:35:b0:8e:34:df:f7:6b:33:5c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Chains

Apr 14, 2019

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 29, 2015 - Jun 9, 2027

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Serial Number

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 5, 2018 - Dec 5, 2019

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 8, 2016 - May 30, 2027

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 29, 2015 - Jun 9, 2027

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Serial Number

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 5, 2018 - Dec 5, 2019

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 8, 2016 - May 30, 2027

Minor OS version

Major OS version

Entry point

587224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptSetHashParam CryptGetHashParam CryptExportKey CryptAcquireContextW CryptSetKeyParam CryptGetKeyParam CryptReleaseContext CryptDuplicateKey CryptAcquireContextA CryptGetProvParam CryptImportKey SystemFunction007 CryptEncrypt CryptCreateHash CryptGenKey CryptDestroyKey CryptDecrypt CryptDestroyHash CryptHashData CopySid GetLengthSid LsaQueryInformationPolicy LsaOpenPolicy LsaClose CreateWellKnownSid CreateProcessWithLogonW CreateProcessAsUserW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegSetValueExW SystemFunction032 ConvertSidToStringSidW CreateServiceW CloseServiceHandle DeleteService OpenSCManagerW SetServiceObjectSecurity OpenServiceW BuildSecurityDescriptorW QueryServiceObjectSecurity StartServiceW AllocateAndInitializeSid QueryServiceStatusEx FreeSid ControlService IsTextUnicode OpenProcessToken GetTokenInformation LookupAccountNameW LookupAccountSidW DuplicateTokenEx CheckTokenMembership CryptEnumProvidersW ConvertStringSidToSidW LsaFreeMemory SetThreadToken CryptSetProvParam CryptEnumProviderTypesW SystemFunction006 CryptGetUserKey OpenEventLogW GetNumberOfEventLogRecords ClearEventLogW SystemFunction001 CryptDeriveKey SystemFunction005 LsaQueryTrustedDomainInfoByName CryptSignHashW LsaOpenSecret LsaQuerySecret SystemFunction013 LsaRetrievePrivateData LsaEnumerateTrustedDomainsEx LookupPrivilegeValueW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW IsValidSid LookupPrivilegeNameW OpenThreadToken CredFree CredEnumerateW GetSidSubAuthority GetSidSubAuthorityCount SystemFunction025 ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction024 CredIsMarshaledCredentialW CredUnmarshalCredentialW A_SHAFinal A_SHAInit A_SHAUpdate

cabinet

ord11 ord14 ord10 ord13

crypt32

CertFindCertificateInStore CryptEncodeObject CertEnumSystemStore CryptSignAndEncodeCertificate CertEnumCertificatesInStore CertAddEncodedCertificateToStore CertOpenStore CertFreeCertificateContext CertCloseStore CertSetCertificateContextProperty PFXExportCertStoreEx CryptUnprotectData CryptBinaryToStringW CryptStringToBinaryW CryptProtectData CryptExportPublicKeyInfo CryptAcquireCertificatePrivateKey CertNameToStrW CertGetNameStringW CertAddCertificateContextToStore CertGetCertificateContextProperty

cryptdll

CDLocateCSystem MD5Final MD5Init CDLocateCheckSum CDGenerateRandomBits MD5Update

dnsapi

DnsFree DnsQuery_A

fltlib

FilterFindFirst FilterFindNext

netapi32

NetServerGetInfo NetStatisticsGet NetShareEnum DsEnumerateDomainTrustsW DsGetDcNameW NetApiBufferFree NetRemoteTOD NetSessionEnum NetWkstaUserEnum I_NetServerTrustPasswordsGet I_NetServerReqChallenge I_NetServerAuthenticate2

ole32

CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantInit SysFreeString SysAllocString

rpcrt4

RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin I_RpcGetCurrentCallHandle NdrClientCall2 RpcMgmtEpEltInqDone RpcBindingFromStringBindingW RpcStringBindingComposeW MesEncodeIncrementalHandleCreate RpcBindingSetAuthInfoExW RpcBindingInqAuthClientW RpcBindingSetOption RpcImpersonateClient RpcBindingFree RpcStringFreeW RpcRevertToSelf MesDecodeIncrementalHandleCreate MesHandleFree MesIncrementalHandleReset NdrMesTypeDecode2 NdrMesTypeAlignSize2 NdrMesTypeFree2 NdrMesTypeEncode2 RpcServerUnregisterIfEx I_RpcBindingInqSecurityContext RpcServerInqBindings RpcServerListen RpcMgmtWaitServerListen RpcEpRegisterW RpcMgmtStopServerListening RpcBindingToStringBindingW RpcServerRegisterIf2 RpcServerRegisterAuthInfoW RpcBindingVectorFree UuidToStringW RpcServerUseProtseqEpW RpcEpUnregister NdrServerCall2 RpcEpResolveBinding UuidCreate

shlwapi

PathIsDirectoryW PathCanonicalizeW PathCombineW PathFindFileNameW PathIsRelativeW

samlib

SamEnumerateGroupsInDomain SamiChangePasswordUser SamSetInformationUser SamGetGroupsForUser SamConnect SamGetMembersInGroup SamRidToSid SamGetMembersInAlias SamEnumerateAliasesInDomain SamGetAliasMembership SamOpenGroup SamQueryInformationUser SamCloseHandle SamEnumerateDomainsInSamServer SamFreeMemory SamEnumerateUsersInDomain SamOpenUser SamLookupDomainInSamServer SamLookupNamesInDomain SamLookupIdsInDomain SamOpenDomain SamOpenAlias

secur32

QueryContextAttributesW FreeContextBuffer LsaDeregisterLogonProcess LsaLookupAuthenticationPackage LsaFreeReturnBuffer DeleteSecurityContext LsaConnectUntrusted FreeCredentialsHandle EnumerateSecurityPackagesW AcquireCredentialsHandleW InitializeSecurityContextW LsaCallAuthenticationPackage

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW GetKeyboardLayout DispatchMessageW DefWindowProcW SetClipboardViewer SendMessageW GetClipboardSequenceNumber OpenClipboard CreateWindowExW ChangeClipboardChain GetClipboardData RegisterClassExW TranslateMessage EnumClipboardFormats PostMessageW UnregisterClassW GetMessageW CloseClipboard DestroyWindow

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

hid

HidD_GetAttributes HidD_GetHidGuid HidD_GetPreparsedData HidD_GetFeature HidP_GetCaps HidD_FreePreparsedData HidD_SetFeature

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

winscard

SCardFreeMemory SCardListCardsW SCardControl SCardGetCardTypeProviderNameW SCardReleaseContext SCardListReadersW SCardEstablishContext SCardConnectW SCardTransmit SCardDisconnect SCardGetAttrib

winsta

WinStationCloseServer WinStationOpenServerW WinStationFreeMemory WinStationConnectW WinStationQueryInformationW WinStationEnumerateW

wldap32

ord122 ord14 ord88 ord157 ord133 ord27 ord147 ord167 ord26 ord127 ord224 ord113 ord309 ord54 ord142 ord77 ord13 ord208 ord145 ord36 ord79 ord41 ord73 ord310 ord203 ord69 ord139 ord97 ord223 ord304 ord12 ord96 ord301 ord140

msasn1

ASN1_CreateModule ASN1_CloseEncoder ASN1_CreateDecoder ASN1_FreeEncoded ASN1_CloseModule ASN1_CreateEncoder ASN1_CloseDecoder ASN1BERDotVal2Eoid

ntdll

wcsncmp _wcstoui64 strchr strstr wcstol wcstoul strcspn strncmp memmove wcsstr _wcsnicmp strtoul wcschr wcsrchr _stricmp _vscwprintf _wcsicmp strrchr _vsnprintf __chkstk RtlUnicodeStringToAnsiString RtlFreeAnsiString RtlDowncaseUnicodeString RtlFreeUnicodeString RtlInitUnicodeString RtlEqualUnicodeString NtQueryObject RtlCompressBuffer RtlGetCompressionWorkSpaceSize NtQuerySystemInformation RtlGetCurrentPeb NtQueryInformationProcess RtlCreateUserThread RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlEqualString RtlUpcaseUnicodeString RtlAppendUnicodeStringToString RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtResumeProcess RtlAdjustPrivilege NtSuspendProcess NtTerminateProcess NtQuerySystemEnvironmentValueEx NtSetSystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW RtlIpv6AddressToStringW towupper memcmp

kernel32

GetFullPathNameA HeapReAlloc GetTimeFormatW WideCharToMultiByte GetSystemTimeAsFileTime SystemTimeToFileTime GetDateFormatW lstrlenW PurgeComm RtlVirtualUnwind LoadLibraryA GetProcessId ClearCommError CreateRemoteThread WaitForSingleObject SetLastError CreateProcessW SetConsoleOutputCP GetConsoleOutputCP CreateFileMappingW UnmapViewOfFile MapViewOfFile WriteProcessMemory VirtualAllocEx VirtualProtectEx VirtualAlloc ReadProcessMemory VirtualFreeEx VirtualQueryEx VirtualFree VirtualQuery GetComputerNameExW DeviceIoControl DuplicateHandle OpenProcess GetCurrentProcess ExpandEnvironmentStringsW FindNextFileW FindClose GetCurrentDirectoryW GetFileSizeEx FlushFileBuffers GetFileAttributesW FindFirstFileW DeleteFileA GetTempPathA GetFileInformationByHandle FileTimeToLocalFileTime GetCurrentDirectoryA GetTempFileNameA SetFilePointer CreateFileA FileTimeToDosDateTime CreateThread LocalFree CloseHandle LocalAlloc GetLastError CreateFileW ReadFile TerminateThread WriteFile FileTimeToSystemTime Sleep VirtualProtect CreateMutexW HeapCompact TryEnterCriticalSection SetEndOfFile HeapAlloc QueryPerformanceCounter HeapFree UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap FormatMessageA InitializeCriticalSection FormatMessageW GetVersionExW HeapDestroy GetFileSize LeaveCriticalSection GetFileAttributesA HeapCreate HeapValidate MultiByteToWideChar GetTempPathW HeapSize LockFileEx EnterCriticalSection GetDiskFreeSpaceW CreateFileMappingA GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW DeleteCriticalSection OutputDebugStringA GetVersionExA DeleteFileW GetCurrentProcessId GetSystemTime AreFileApisANSI ExitProcess RaiseException SetConsoleCtrlHandler SetConsoleTitleW lstrlenA FreeLibrary LoadLibraryW GetProcAddress GlobalSize GetModuleHandleW SetHandleInformation CreatePipe SetEvent CreateEventW GetSystemDirectoryW RtlLookupFunctionEntry RtlCaptureContext TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentThreadId GetFullPathNameW SetConsoleCursorPosition GetTimeZoneInformation GetStdHandle FillConsoleOutputCharacterW GetConsoleScreenBufferInfo GetComputerNameW ProcessIdToSessionId GetCurrentThread SetCurrentDirectoryW

msvcrt

isdigit isspace __set_app_type mbtowc __mb_cur_max isleadbyte isxdigit localeconv _snprintf _itoa calloc wctomb ferror iswctype wcstombs ?terminate@@YAXXZ __badioinfo __pioinfo _read _lseeki64 _write _isatty ungetc fgetws _fmode realloc strftime _commode __setusermatherr _amsg_exit _initterm exit _cexit _exit _XcptFilter __wgetmainargs __C_specific_handler memset _msize memcpy getchar _errno free _wcsdup vfwprintf fflush _wfopen wprintf _fileno _iob vwprintf _setmode fclose gmtime malloc _wpgmptr

generic

count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=62, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,

count=2, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=2, id=132, productName=VS2008 build 21022, version=21022,

count=47, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=629, id=1, productName=Unmarked objects,

count=1, id=126, version=50727,

count=95, id=137, version=30729,

count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,