mimikatz

General

Target

2024-06-03_90584bc9135bfa34fa69dc1fb7bca979_hacktools_icedid_mimikatz
Size

8.0MB
Sample

240603-hcsteaeh6t
MD5

90584bc9135bfa34fa69dc1fb7bca979
SHA1

eeadc942bacf912bd30da2d054f7a8efa2bb2b31
SHA256

4ea6cd3669552752b5b8a9e026aa29314d707777515404bb95bb58f063601dd2
SHA512

ad9291b193e33bf9f48c52c478567cea255610242fa22df0eb023a9ae23bdcaf25b7daaf88a11156c91b56b91338fbaeb777dd12fb3703a5ffd4bbc2375a4786
SSDEEP

196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Score

10^/10

Malware Config

Targets

- Target
  
  2024-06-03_90584bc9135bfa34fa69dc1fb7bca979_hacktools_icedid_mimikatz
- Size
  
  8.0MB
- MD5
  
  90584bc9135bfa34fa69dc1fb7bca979
- SHA1
  
  eeadc942bacf912bd30da2d054f7a8efa2bb2b31
- SHA256
  
  4ea6cd3669552752b5b8a9e026aa29314d707777515404bb95bb58f063601dd2
- SHA512
  
  ad9291b193e33bf9f48c52c478567cea255610242fa22df0eb023a9ae23bdcaf25b7daaf88a11156c91b56b91338fbaeb777dd12fb3703a5ffd4bbc2375a4786
- SSDEEP
  
  196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1
Score

10^/10

mimikatz xmrig discovery evasion execution miner persistence upx
- Disables service(s)
  evasion execution
- Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- Suspicious use of NtCreateUserProcessOtherParentProcess
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Contacts a large (23489) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- mimikatz is an open source tool to dump credentials on Windows
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates a Windows Service
  persistence
- Drops file in System32 directory
behavioral1 behavioral2