mimikatz | 417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632

General

Target
417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
Size 1.1MB
Sample240612-bqq4eaxelg
SHA256 417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632
MD5 bceaadd320aaa1bc88b2e670b6ea4e16
SHA1 8cb2d9312eb4c8beea071f692b55c5f1a2a38fea
SHA512 71938de64075cb5aaad692529c7aea612ada995c11d71b8e917a703b416b68d643628e1e5aba89c3a0e58f3ce5b5e31cdefa179227d2340ce2425b0e557c979d
SSDEEP 24576:Ld9Mrf7iaNVxowuT2hn4VXlM0fDfJN0KfMrw:ByTeFw6W4V11fDfvurw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023550-21.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023550-21.dat	mimikatz

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe

Executes dropped EXE 1 IoCs

pid	Process
876	mimikatz.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Help\Help\kiwi_passwords.yar	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File opened for modification	C:\Windows\Help\Help\x64\mimidrv.sys	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File opened for modification	C:\Windows\Help\Help\mimicom.idl	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File opened for modification	C:\Windows\Help\Help\6.bat	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File created	C:\Windows\Help\Help\x64\mimilib.dll	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File opened for modification	C:\Windows\Help\Help\x64\mimispool.dll	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File opened for modification	C:\Windows\Help\Help\README.md	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File created	C:\Windows\Help\Help\x64\mimikatz.exe	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File created	C:\Windows\Help\Help\kiwi_passwords.yar	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File opened for modification	C:\Windows\Help\Help\x64\mimilib.dll	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File created	C:\Windows\Help\Help\README.md	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File created	C:\Windows\Help\Help\mimicom.idl	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File created	C:\Windows\Help\Help\x64\mimispool.dll	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File created	C:\Windows\Help\Help\x64\mimidrv.sys	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File opened for modification	C:\Windows\Help\Help\x64	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File created	C:\Windows\Help\Help\6.bat	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
File opened for modification	C:\Windows\Help\Help\x64\mimikatz.exe	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4676	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
876	mimikatz.exe
876	mimikatz.exe
876	mimikatz.exe
876	mimikatz.exe
876	mimikatz.exe
876	mimikatz.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4692	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
Token: SeDebugPrivilege	876	mimikatz.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 2012	4692	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe	90
PID 4692 wrote to memory of 2012	4692	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe	90
PID 4692 wrote to memory of 2012	4692	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe	90
PID 4692 wrote to memory of 4164	4692	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe	92
PID 4692 wrote to memory of 4164	4692	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe	92
PID 4692 wrote to memory of 4164	4692	417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe	92
PID 2012 wrote to memory of 876	2012	cmd.exe	94
PID 2012 wrote to memory of 876	2012	cmd.exe	94
PID 2012 wrote to memory of 3660	2012	cmd.exe	95
PID 2012 wrote to memory of 3660	2012	cmd.exe	95
PID 2012 wrote to memory of 3660	2012	cmd.exe	95
PID 4164 wrote to memory of 4676	4164	cmd.exe	96
PID 4164 wrote to memory of 4676	4164	cmd.exe	96
PID 4164 wrote to memory of 4676	4164	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe
"C:\Users\Admin\AppData\Local\Temp\417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Help\Help\6.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\Help\Help\x64\mimikatz.exe
    x64\mimikatz.exe privilege::debug sekurlsa::logonpasswords
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Executed 64. You can close ."
    3⤵
    PID:3660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\HZ~E7C0.tmp.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HZ~E7C0.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\HZ~E7C0.tmp.bat
Size 266B
SHA256 8002daa6ef3f31795e169f5c918f74e600ce5dd3de6eeaf2c43e3039ebf76a58
MD5 426f3026e337838ffd9399a92d0f6167
SHA1 9a507d764fc62a056da5a702d2d5a3a3ebb12690
SHA512 1c187189bacf74a0b3591b1937de269712114d770d77aa41af757e337a70999773fd361d03e150053c3e6b130595cf6ad847af96c7f1b39a5420bfc163ea7c2c
MD5 SHA1 SHA512

Submit Download

6.bat

Path C:\Windows\Help\Help\6.bat
Size 193B
SHA256 c9ef6a33c87a2599a93ea6eaa003cfb85eac3a4f684defd9ea8b49e66033e655
MD5 efcf8e427a3a1834c2af5dfc9372704c
SHA1 34c53c4307636ec39ec148940196246c7b0f2e95
SHA512 876bac58d75d1a84f9362ecc7edaebaeaa0e4e5bbbce4b89f0356ef563d566c3a9ea960bd481849e3bb4263ffa70ff142b064a7f431b2e4e8f8dc04a4472afd5
MD5 SHA1 SHA512

Submit Download

mimikatz.exe

Path C:\Windows\Help\Help\x64\mimikatz.exe
Size 1.3MB
SHA256 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5
SHA1 e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
SHA512 f00b1ab035aa574c70f6b95b63f676fa75ff8f379f92e85ad5872c358a6bb1ed5417fdd226d421307a48653577ca42aba28103b3b2d7a5c572192d6e5f07e8b3
SSDEEP 24576:0CgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODvsG:0CI7XBE2IuF64rIlmdii
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads