mimikatz | 1bae55baa2dfe26ecc9b148bc2c9820ce05e0fbbfe907a3a116aa08546fabe6d | Triage

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 01:04

Sharing

Report Analysis Logs

General

Target

mimikatz_trunk/Win32/mimidrv.sys
Size

29KB
MD5

0818699d065afcb1f397d578d3708dc2
SHA1

df107aa0214b914c645967eddff6fdda88152eba
SHA256

4ff7578df7293e50c9bdd48657a6ba0c60e1f6d06a2dd334f605af34fe6f75a5
SHA512

f6f89627a1be33788d576acebf16d36fbfa1b6f89d8cb9191771146231ccb5d77af11aa70640813e473872c83171cc4606f490d16d1bce322926046a5bc80cdd
SSDEEP

768:Bk0ByYHIVcmG9yJao/fZ+B8zlu7TVHZC5is5c:BZyYGG92LHMB8zl8TJwism

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral2/memory/1236-0-0x0000000000010000-0x000000000001B000-memory.dmp	mimikatz

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mimikatz_trunk\Win32\mimidrv.sys
1⤵
PID:4380
- C:\Users\Admin\AppData\Local\Temp\mimikatz_trunk\Win32\mimidrv.sys
  C:\Users\Admin\AppData\Local\Temp\mimikatz_trunk\Win32\mimidrv.sys
  2⤵
  PID:1236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-0-0x0000000000010000-0x000000000001B000-memory.dmp

Filesize
44KB

Download