mimikatz | b2a9d9fa76e0d276d2a9ee93a0cd32a7796ffa5c5481dba57c89c0590fb61d09

General

Target
New/6mm.exe
Size 1.1MB
Sample240611-v35bcavdmb
SHA256 417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632
MD5 bceaadd320aaa1bc88b2e670b6ea4e16
SHA1 8cb2d9312eb4c8beea071f692b55c5f1a2a38fea
SHA512 71938de64075cb5aaad692529c7aea612ada995c11d71b8e917a703b416b68d643628e1e5aba89c3a0e58f3ce5b5e31cdefa179227d2340ce2425b0e557c979d
SSDEEP 24576:Ld9Mrf7iaNVxowuT2hn4VXlM0fDfJN0KfMrw:ByTeFw6W4V11fDfvurw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000002aa22-21.dat	mimikatz

Executes dropped EXE 1 IoCs

pid	Process
4320	mimikatz.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Help\Help\README.md	6mm.exe
File opened for modification	C:\Windows\Help\Help\mimicom.idl	6mm.exe
File created	C:\Windows\Help\Help\6.bat	6mm.exe
File opened for modification	C:\Windows\Help\Help\6.bat	6mm.exe
File created	C:\Windows\Help\Help\x64\mimikatz.exe	6mm.exe
File created	C:\Windows\Help\Help\x64\mimispool.dll	6mm.exe
File opened for modification	C:\Windows\Help\Help\x64\mimispool.dll	6mm.exe
File opened for modification	C:\Windows\Help\Help\x64\mimidrv.sys	6mm.exe
File created	C:\Windows\Help\Help\kiwi_passwords.yar	6mm.exe
File opened for modification	C:\Windows\Help\Help\x64\mimilib.dll	6mm.exe
File opened for modification	C:\Windows\Help\Help\x64	6mm.exe
File created	C:\Windows\Help\Help\README.md	6mm.exe
File created	C:\Windows\Help\Help\mimicom.idl	6mm.exe
File opened for modification	C:\Windows\Help\Help\kiwi_passwords.yar	6mm.exe
File opened for modification	C:\Windows\Help\Help\x64\mimikatz.exe	6mm.exe
File created	C:\Windows\Help\Help\x64\mimilib.dll	6mm.exe
File created	C:\Windows\Help\Help\x64\mimidrv.sys	6mm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4740	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4320	mimikatz.exe
4320	mimikatz.exe
4320	mimikatz.exe
4320	mimikatz.exe
4320	mimikatz.exe
4320	mimikatz.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3552	6mm.exe
Token: SeDebugPrivilege	4320	mimikatz.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 2268	3552	6mm.exe	78
PID 3552 wrote to memory of 2268	3552	6mm.exe	78
PID 3552 wrote to memory of 2268	3552	6mm.exe	78
PID 3552 wrote to memory of 3496	3552	6mm.exe	80
PID 3552 wrote to memory of 3496	3552	6mm.exe	80
PID 3552 wrote to memory of 3496	3552	6mm.exe	80
PID 2268 wrote to memory of 4320	2268	cmd.exe	82
PID 2268 wrote to memory of 4320	2268	cmd.exe	82
PID 2268 wrote to memory of 1876	2268	cmd.exe	83
PID 2268 wrote to memory of 1876	2268	cmd.exe	83
PID 2268 wrote to memory of 1876	2268	cmd.exe	83
PID 3496 wrote to memory of 4740	3496	cmd.exe	84
PID 3496 wrote to memory of 4740	3496	cmd.exe	84
PID 3496 wrote to memory of 4740	3496	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\New\6mm.exe
"C:\Users\Admin\AppData\Local\Temp\New\6mm.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Help\Help\6.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\Help\Help\x64\mimikatz.exe
    x64\mimikatz.exe privilege::debug sekurlsa::logonpasswords
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Executed 64. You can close ."
    3⤵
    PID:1876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\HZ~8230.tmp.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HZ~8230.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\HZ~8230.tmp.bat
Size 152B
SHA256 b9e5dc6db7fb54f789efd12e96adc764f9345bc34ac0ab78acec6b8377502f81
MD5 c1e4e4aa9c618aec00996675fb8555dc
SHA1 5a5e72bc65918f20d8a62cc41dd77f36ba665e6a
SHA512 56f95e9335fc690b99db5938056edc9fd17853a30bdd12b56cc81d5884b3abfbcf43e2a927d4c2c9d467051618d92ce2126cc2fa1d2725de8b7d014d6545c37b
MD5 SHA1 SHA512

Submit Download

6.bat

Path C:\Windows\Help\Help\6.bat
Size 193B
SHA256 c9ef6a33c87a2599a93ea6eaa003cfb85eac3a4f684defd9ea8b49e66033e655
MD5 efcf8e427a3a1834c2af5dfc9372704c
SHA1 34c53c4307636ec39ec148940196246c7b0f2e95
SHA512 876bac58d75d1a84f9362ecc7edaebaeaa0e4e5bbbce4b89f0356ef563d566c3a9ea960bd481849e3bb4263ffa70ff142b064a7f431b2e4e8f8dc04a4472afd5
MD5 SHA1 SHA512

Submit Download

mimikatz.exe

Path C:\Windows\Help\Help\x64\mimikatz.exe
Size 1.3MB
SHA256 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5
SHA1 e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
SHA512 f00b1ab035aa574c70f6b95b63f676fa75ff8f379f92e85ad5872c358a6bb1ed5417fdd226d421307a48653577ca42aba28103b3b2d7a5c572192d6e5f07e8b3
SSDEEP 24576:0CgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODvsG:0CI7XBE2IuF64rIlmdii
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads