mimikatz | b294f94c469f43a78a324b5cfecbde0afb3aa0256bbde06ca2718b8c038a9324[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
b294f94c469f43a78a324b5cfecbde0afb3aa0256bbde06ca2718b8c038a9324.exe
Size 979KB
Sample240613-cbt27azfpd
SHA256 b294f94c469f43a78a324b5cfecbde0afb3aa0256bbde06ca2718b8c038a9324
MD5 297b896dbf8d619c61fd947086fce6e8
SHA1 7cb9486abe2317e735bf2e2ddb58992835ac7556
SHA512 0726206509fae1d29612e04e20a4d2f7c32ef1128eeb861f7e24a4feec62e80ffe27864c5caeb60cf7d7e1dd962eaf535ce76751c3619d8f281c7a2c8e5fac44
SSDEEP 24576:rjEObtgfYpGGQakZ6tXEu3hA+w3552NGQ4wE:3EngmstRhA+wJ5e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b294f94c469f43a78a324b5cfecbde0afb3aa0256bbde06ca2718b8c038a9324.exe

File Explorer

b294f94c469f43a78a324b5cfecbde0afb3aa0256bbde06ca2718b8c038a9324.exe

.exe 979KB

b294f94c469f43a78a324b5cfecbde0afb3aa0256bbde06ca2718b8c038a9324.exe

IMPHASH fc751f775e55aacb1c0c763364369f41
SHA256 b294f94c469f43a78a324b5cfecbde0afb3aa0256bbde06ca2718b8c038a9324
MD5 297b896dbf8d619c61fd947086fce6e8
SHA1 7cb9486abe2317e735bf2e2ddb58992835ac7556
SHA512 0726206509fae1d29612e04e20a4d2f7c32ef1128eeb861f7e24a4feec62e80ffe27864c5caeb60cf7d7e1dd962eaf535ce76751c3619d8f281c7a2c8e5fac44
SSDEEP 24576:rjEObtgfYpGGQakZ6tXEu3hA+w3552NGQ4wE:3EngmstRhA+wJ5e
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

523852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptSetHashParam CryptGetHashParam CryptExportKey CryptAcquireContextW CryptSetKeyParam CryptGetKeyParam CryptReleaseContext CryptDuplicateKey CryptAcquireContextA CryptGetProvParam CryptImportKey SystemFunction007 CryptEncrypt CryptCreateHash CryptGenKey CryptDestroyKey CryptDecrypt CryptDestroyHash CryptHashData CopySid GetLengthSid LsaQueryInformationPolicy LsaOpenPolicy LsaClose CreateWellKnownSid CreateProcessWithLogonW CreateProcessAsUserW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegSetValueExW SystemFunction032 ConvertSidToStringSidW CreateServiceW CloseServiceHandle DeleteService OpenSCManagerW SetServiceObjectSecurity OpenServiceW BuildSecurityDescriptorW QueryServiceObjectSecurity StartServiceW AllocateAndInitializeSid QueryServiceStatusEx FreeSid ControlService IsTextUnicode OpenProcessToken GetTokenInformation LookupAccountNameW LookupAccountSidW DuplicateTokenEx CheckTokenMembership CryptEnumProvidersW ConvertStringSidToSidW LsaFreeMemory SetThreadToken CryptSetProvParam CryptEnumProviderTypesW SystemFunction006 CryptGetUserKey OpenEventLogW GetNumberOfEventLogRecords ClearEventLogW SystemFunction001 CryptDeriveKey SystemFunction005 LsaQueryTrustedDomainInfoByName CryptSignHashW LsaOpenSecret LsaQuerySecret SystemFunction013 LsaRetrievePrivateData LsaEnumerateTrustedDomainsEx LookupPrivilegeValueW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW IsValidSid LookupPrivilegeNameW OpenThreadToken CredFree CredEnumerateW GetSidSubAuthority GetSidSubAuthorityCount SystemFunction025 ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction024 A_SHAUpdate A_SHAFinal A_SHAInit

cabinet

ord11 ord14 ord10 ord13

crypt32

CertGetNameStringW CryptEncodeObject CertEnumSystemStore CryptSignAndEncodeCertificate CertEnumCertificatesInStore CertAddEncodedCertificateToStore CertOpenStore CertFreeCertificateContext CertCloseStore CertSetCertificateContextProperty PFXExportCertStoreEx CryptUnprotectData CryptBinaryToStringW CryptStringToBinaryW CryptProtectData CryptExportPublicKeyInfo CryptAcquireCertificatePrivateKey CertNameToStrW CertGetCertificateContextProperty CertAddCertificateContextToStore CertFindCertificateInStore

cryptdll

CDLocateCSystem MD5Update MD5Final CDGenerateRandomBits CDLocateCheckSum MD5Init

fltlib

FilterFindFirst FilterFindNext

netapi32

DsGetDcNameW NetRemoteTOD NetSessionEnum NetServerGetInfo NetWkstaUserEnum NetStatisticsGet NetShareEnum NetApiBufferFree I_NetServerTrustPasswordsGet I_NetServerReqChallenge I_NetServerAuthenticate2

ole32

CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

SysFreeString VariantInit SysAllocString

rpcrt4

RpcBindingVectorFree UuidToStringW RpcServerUseProtseqEpW NdrServerCall2 NdrClientCall2 UuidCreate RpcEpResolveBinding RpcMgmtEpEltInqDone RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin I_RpcGetCurrentCallHandle RpcEpUnregister RpcBindingFromStringBindingW RpcStringBindingComposeW MesEncodeIncrementalHandleCreate RpcBindingSetAuthInfoExW RpcBindingInqAuthClientW RpcBindingSetOption RpcImpersonateClient RpcBindingFree RpcStringFreeW RpcRevertToSelf MesDecodeIncrementalHandleCreate MesHandleFree MesIncrementalHandleReset NdrMesTypeDecode2 NdrMesTypeAlignSize2 NdrMesTypeFree2 NdrMesTypeEncode2 RpcServerUnregisterIfEx I_RpcBindingInqSecurityContext RpcServerInqBindings RpcServerListen RpcMgmtWaitServerListen RpcEpRegisterW RpcMgmtStopServerListening RpcBindingToStringBindingW RpcServerRegisterIf2 RpcServerRegisterAuthInfoW

shlwapi

PathCombineW PathIsDirectoryW PathCanonicalizeW PathIsRelativeW PathFindFileNameW

samlib

SamGetMembersInGroup SamGetGroupsForUser SamOpenUser SamEnumerateGroupsInDomain SamiChangePasswordUser SamSetInformationUser SamConnect SamOpenDomain SamLookupIdsInDomain SamLookupNamesInDomain SamLookupDomainInSamServer SamRidToSid SamGetMembersInAlias SamEnumerateAliasesInDomain SamGetAliasMembership SamOpenGroup SamOpenAlias SamEnumerateUsersInDomain SamFreeMemory SamEnumerateDomainsInSamServer SamCloseHandle SamQueryInformationUser

secur32

LsaCallAuthenticationPackage DeleteSecurityContext FreeContextBuffer LsaLookupAuthenticationPackage LsaConnectUntrusted LsaFreeReturnBuffer FreeCredentialsHandle EnumerateSecurityPackagesW InitializeSecurityContextW QueryContextAttributesW AcquireCredentialsHandleW LsaDeregisterLogonProcess

shell32

CommandLineToArgvW

user32

GetClipboardSequenceNumber SetClipboardViewer DefWindowProcW DispatchMessageW GetKeyboardLayout IsCharAlphaNumericW EnumClipboardFormats SendMessageW OpenClipboard CreateWindowExW ChangeClipboardChain GetClipboardData RegisterClassExW TranslateMessage PostMessageW DestroyWindow CloseClipboard GetMessageW UnregisterClassW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

hid

HidD_GetPreparsedData HidD_FreePreparsedData HidP_GetCaps HidD_GetFeature HidD_GetAttributes HidD_GetHidGuid HidD_SetFeature

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW

winscard

SCardControl SCardConnectW SCardTransmit SCardDisconnect SCardGetAttrib SCardEstablishContext SCardFreeMemory SCardListReadersW SCardReleaseContext SCardListCardsW SCardGetCardTypeProviderNameW

winsta

WinStationCloseServer WinStationEnumerateW WinStationOpenServerW WinStationFreeMemory WinStationConnectW WinStationQueryInformationW

wldap32

ord122 ord310 ord309 ord304 ord301 ord73 ord127 ord41 ord26 ord157 ord79 ord36 ord145 ord208 ord167 ord147 ord13 ord27 ord77 ord142 ord133 ord88 ord14 ord96 ord224 ord113 ord12 ord223 ord97 ord139 ord69 ord203 ord140 ord54

msasn1

ASN1_CloseEncoder ASN1_CreateDecoder ASN1BERDotVal2Eoid ASN1_CloseDecoder ASN1_CreateModule ASN1_FreeEncoded ASN1_CloseModule ASN1_CreateEncoder

ntdll

RtlGetCurrentPeb RtlGetCompressionWorkSpaceSize NtQueryInformationProcess NtQueryObject RtlEqualUnicodeString RtlInitUnicodeString RtlFreeUnicodeString RtlDowncaseUnicodeString RtlFreeAnsiString RtlUnicodeStringToAnsiString RtlCreateUserThread RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlEqualString RtlUpcaseUnicodeString RtlAppendUnicodeStringToString RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtResumeProcess RtlAdjustPrivilege NtSuspendProcess NtTerminateProcess NtQuerySystemEnvironmentValueEx NtSetSystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW RtlIpv6AddressToStringW RtlCompressBuffer NtQuerySystemInformation

kernel32

SetFilePointerEx FreeEnvironmentStringsW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetModuleFileNameW GetStartupInfoW GetFileType SetStdHandle GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount RtlUnwindEx GetCurrentThreadId GetCPInfo GetOEMCP GetACP IsValidCodePage IsProcessorFeaturePresent IsDebuggerPresent GetCommandLineW GetModuleHandleExW LoadLibraryExW DecodePointer EncodePointer LoadLibraryExA GetProcessId GetComputerNameW ProcessIdToSessionId GetCurrentThread SetCurrentDirectoryW GetConsoleScreenBufferInfo FillConsoleOutputCharacterW GetStdHandle GetTimeZoneInformation SetConsoleCursorPosition GetSystemDirectoryW CreateEventW SetEvent CreatePipe SetHandleInformation GetModuleHandleW GlobalSize GetProcAddress LoadLibraryW FreeLibrary lstrlenA SetConsoleTitleW SetConsoleCtrlHandler RaiseException ExitProcess AreFileApisANSI GetSystemTime GetCurrentProcessId DeleteFileW GetVersionExA OutputDebugStringA DeleteCriticalSection GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA GetDiskFreeSpaceW EnterCriticalSection LockFileEx HeapSize GetTempPathW MultiByteToWideChar HeapValidate HeapCreate GetFileAttributesA LeaveCriticalSection HeapDestroy GetVersionExW FormatMessageW InitializeCriticalSection FormatMessageA GetProcessHeap UnlockFileEx GetTickCount OutputDebugStringW WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile HeapFree QueryPerformanceCounter HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact CreateMutexW GetFileSize HeapReAlloc GetFullPathNameA GetFullPathNameW GetTimeFormatW WideCharToMultiByte GetSystemTimeAsFileTime SystemTimeToFileTime GetDateFormatW lstrlenW PurgeComm ClearCommError CreateRemoteThread WaitForSingleObject SetLastError CreateProcessW SetConsoleOutputCP GetConsoleOutputCP CompareStringW LCMapStringW WriteConsoleW ReadConsoleW SetEnvironmentVariableA GetEnvironmentStringsW CreateFileMappingW UnmapViewOfFile MapViewOfFile WriteProcessMemory VirtualProtect VirtualAllocEx VirtualProtectEx VirtualAlloc ReadProcessMemory VirtualFreeEx VirtualQueryEx VirtualFree VirtualQuery GetComputerNameExW DeviceIoControl DuplicateHandle OpenProcess GetCurrentProcess ExpandEnvironmentStringsW FindNextFileW FindClose GetCurrentDirectoryW GetFileSizeEx FlushFileBuffers GetFileAttributesW FindFirstFileW DeleteFileA GetTempPathA GetFileInformationByHandle FileTimeToLocalFileTime GetCurrentDirectoryA GetTempFileNameA SetFilePointer CreateFileA FileTimeToDosDateTime CreateThread LocalFree CloseHandle LocalAlloc GetLastError CreateFileW ReadFile Sleep TerminateThread WriteFile FileTimeToSystemTime