mimikatz | e20d23481a114d78d961f2e37dc5fd6e[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
e20d23481a114d78d961f2e37dc5fd6e.bin
Size 1.6MB
Sample240614-df8a2ssgjh
SHA256 35c095bb57000120c1f673dba6b56bf54b9370866129c8e8a70ad1e4ea72f01e
MD5 add4032f704b6413083bf907c3ba4e5a
SHA1 3cacbe980606bce0c3c641e2db9d35882a37a717
SHA512 2af743a1c8148bf5d736483a333938f3f0762fdef418cc9f3209dda6459849aad97fee55660eb63d8bcdb63f745a471513ddea92ca7954e01020a2e8d6a520d2
SSDEEP 24576:HNdempj02mwndnqs0RoQPPU2rRUp2XDkForRF/JCWh5hAoEfYmmpbdqS+kSX:tws02HpqBRoKtXwForJC25DpCX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 7 IoCs

resource	yara_rule
static1/unpack002/mimikatz_trunk/Win32/mimidrv.sys	mimikatz
static1/unpack002/mimikatz_trunk/Win32/mimikatz.exe	mimikatz
static1/unpack002/mimikatz_trunk/Win32/mimilib.dll	mimikatz
static1/unpack002/mimikatz_trunk/x64/mimidrv.sys	mimikatz
static1/unpack002/mimikatz_trunk/x64/mimikatz.exe	mimikatz
static1/unpack002/mimikatz_trunk/x64/mimilib.dll	mimikatz
static1/unpack002/mimikatz_trunk/x64/mz64.exe	mimikatz

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack002/mimikatz_trunk/Win32/mimikatz.exe
unpack002/mimikatz_trunk/Win32/mimilib.dll
unpack002/mimikatz_trunk/Win32/mimilove.exe
unpack002/mimikatz_trunk/Win32/mimispool.dll
unpack002/mimikatz_trunk/x64/mimikatz.exe
unpack002/mimikatz_trunk/x64/mimilib.dll
unpack002/mimikatz_trunk/x64/mimispool.dll
unpack002/mimikatz_trunk/x64/mz64.exe

File Explorer

e20d23481a114d78d961f2e37dc5fd6e.bin

.zip 1.6MB
1bae55baa2dfe26ecc9b148bc2c9820ce05e0fbbfe907a3a116aa08546fabe6d.zip

.zip 1.6MB
mimikatz_trunk/README.md

5KB
mimikatz_trunk/Win32/mimidrv.sys

.sys 29KB
mimikatz_trunk/Win32/mimikatz.exe

.exe 1.0MB
mimikatz_trunk/Win32/mimilib.dll

.dll 31KB
mimikatz_trunk/Win32/mimilove.exe

.exe 24KB
mimikatz_trunk/Win32/mimispool.dll

.dll 10KB
mimikatz_trunk/data.txt

186B
mimikatz_trunk/kiwi_passwords.yar

2KB
mimikatz_trunk/mimicom.idl

2KB
mimikatz_trunk/x64/mimidrv.sys

.sys 36KB
mimikatz_trunk/x64/mimikatz.exe

.exe 1.3MB
mimikatz_trunk/x64/mimilib.dll

.dll 36KB
mimikatz_trunk/x64/mimispool.dll

.dll 10KB
mimikatz_trunk/x64/mz64.exe

.exe 979KB

e20d23481a114d78d961f2e37dc5fd6e.bin

SHA256 35c095bb57000120c1f673dba6b56bf54b9370866129c8e8a70ad1e4ea72f01e
MD5 add4032f704b6413083bf907c3ba4e5a
SHA1 3cacbe980606bce0c3c641e2db9d35882a37a717
SHA512 2af743a1c8148bf5d736483a333938f3f0762fdef418cc9f3209dda6459849aad97fee55660eb63d8bcdb63f745a471513ddea92ca7954e01020a2e8d6a520d2
SSDEEP 24576:HNdempj02mwndnqs0RoQPPU2rRUp2XDkForRF/JCWh5hAoEfYmmpbdqS+kSX:tws02HpqBRoKtXwForJC25DpCX
MD5 SHA1 SHA512 SSDEEP

Password

infected

mimikatz_trunk/Win32/mimidrv.sys

IMPHASH 25862203800205f80fd8b3a6634ea1c6
SHA256 4ff7578df7293e50c9bdd48657a6ba0c60e1f6d06a2dd334f605af34fe6f75a5
MD5 0818699d065afcb1f397d578d3708dc2
SHA1 df107aa0214b914c645967eddff6fdda88152eba
SHA512 f6f89627a1be33788d576acebf16d36fbfa1b6f89d8cb9191771146231ccb5d77af11aa70640813e473872c83171cc4606f490d16d1bce322926046a5bc80cdd
SSDEEP 768:Bk0ByYHIVcmG9yJao/fZ+B8zlu7TVHZC5is5c:BZyYGG92LHMB8zl8TJwism
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

mimikatz is an open source tool to dump credentials on Windows

PE Signature issue

Digest

dc:8a:cb:ab:b1:b0:e6:23:7a:ba:7f:42:cf:c5:23:ba:62:ef:0a:a6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Benjamin Delpy,C=FR

Chains

Jun 12, 2024

Minor OS version

Major OS version

Entry point

32830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\security\mimikatz\mimidrv\objfre_wnet_x86\i386\mimidrv.pdb

Name

.text

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1024B

Virtual Size

614B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mimikatz_trunk/Win32/mimikatz.exe

IMPHASH ff6abb25b3369620afef1dacd4a21f4c
SHA256 94795fd89366e01bd6ce6471ff27c3782e2e16377a848426cf0b2e6baee9449b
MD5 d3b17ddf0b98fd2441ed46b033043456
SHA1 93ed68c7e5096d936115854954135d110648e739
SHA512 cac2230361981323ea998c08f7d9afc9369c62a683a60421628adab1eb1e4ffbbc9c2239a8bf66cb662ad7d56e7284f9051bb548979b8c6862570ce45aa27120
SSDEEP 24576:uiDjF7X3YoGq4tC1YJk+3nWBkDeq26iLutKcEY4:u05YjqakE3Aq2vu7E
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

621122

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

CryptSetHashParam CryptGetHashParam CryptExportKey CryptAcquireContextW CryptSetKeyParam CryptGetKeyParam CryptReleaseContext CryptDuplicateKey CryptAcquireContextA CryptGetProvParam CryptImportKey SystemFunction007 CryptEncrypt CryptCreateHash CryptGenKey CryptDestroyKey CryptDecrypt CryptDestroyHash CryptHashData CopySid GetLengthSid LsaQueryInformationPolicy LsaOpenPolicy LsaClose CreateWellKnownSid CreateProcessWithLogonW CreateProcessAsUserW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegSetValueExW SystemFunction033 SystemFunction032 ConvertSidToStringSidW CreateServiceW CloseServiceHandle DeleteService OpenSCManagerW SetServiceObjectSecurity OpenServiceW BuildSecurityDescriptorW QueryServiceObjectSecurity StartServiceW AllocateAndInitializeSid QueryServiceStatusEx FreeSid ControlService IsTextUnicode OpenProcessToken GetTokenInformation LookupAccountNameW LookupAccountSidW DuplicateTokenEx CheckTokenMembership CryptSetProvParam CryptEnumProvidersW ConvertStringSidToSidW LsaFreeMemory GetSidSubAuthority GetSidSubAuthorityCount IsValidSid SetThreadToken CryptEnumProviderTypesW SystemFunction006 CryptGetUserKey OpenEventLogW GetNumberOfEventLogRecords ClearEventLogW SystemFunction001 CryptDeriveKey SystemFunction005 LsaQueryTrustedDomainInfoByName CryptSignHashW LsaSetSecret SystemFunction023 LsaOpenSecret LsaQuerySecret LsaRetrievePrivateData LsaEnumerateTrustedDomainsEx LookupPrivilegeValueW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW LookupPrivilegeNameW OpenThreadToken EqualSid CredFree CredEnumerateW SystemFunction026 ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction027 SystemFunction041 CredIsMarshaledCredentialW CredUnmarshalCredentialW A_SHAFinal A_SHAInit A_SHAUpdate

cabinet

ord11 ord14 ord10 ord13

crypt32

CryptSignAndEncodeCertificate CertEnumSystemStore CertEnumCertificatesInStore CertAddCertificateContextToStore CryptDecodeObjectEx CryptStringToBinaryA CertAddEncodedCertificateToStore CertOpenStore CertFreeCertificateContext CertCloseStore CryptStringToBinaryW CertSetCertificateContextProperty PFXExportCertStoreEx CryptUnprotectData CryptBinaryToStringW CryptBinaryToStringA CryptExportPublicKeyInfo CryptFindOIDInfo CryptAcquireCertificatePrivateKey CertNameToStrW CertFindCertificateInStore CertGetCertificateContextProperty CertGetNameStringW CryptEncodeObject CryptProtectData CryptQueryObject

cryptdll

MD5Update MD5Final CDLocateCSystem MD5Init CDLocateCheckSum CDGenerateRandomBits

dnsapi

DnsFree DnsQuery_A

fltlib

FilterFindFirst FilterFindNext

mpr

WNetCancelConnection2W WNetAddConnection2W

netapi32

NetStatisticsGet DsGetDcNameW NetApiBufferFree NetRemoteTOD NetSessionEnum NetServerGetInfo DsEnumerateDomainTrustsW NetShareEnum NetWkstaUserEnum I_NetServerAuthenticate2 I_NetServerTrustPasswordsGet I_NetServerReqChallenge

odbc32

ord75 ord9 ord43 ord24 ord31 ord111 ord141 ord13

ole32

CoTaskMemFree CoSetProxyBlanket CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

SysAllocString VariantInit SysFreeString VariantClear

rpcrt4

RpcBindingFree RpcBindingFromStringBindingW RpcStringBindingComposeW MesEncodeIncrementalHandleCreate RpcBindingSetAuthInfoExW RpcBindingInqAuthClientW RpcBindingSetOption RpcImpersonateClient RpcStringFreeW RpcRevertToSelf MesDecodeIncrementalHandleCreate MesHandleFree MesIncrementalHandleReset NdrMesTypeDecode2 NdrMesTypeAlignSize2 NdrMesTypeFree2 NdrMesTypeEncode2 RpcServerUnregisterIfEx I_RpcBindingInqSecurityContext RpcServerInqBindings RpcServerListen RpcMgmtWaitServerListen RpcEpRegisterW RpcMgmtStopServerListening RpcBindingToStringBindingW RpcServerRegisterIf2 RpcServerRegisterAuthInfoW RpcBindingVectorFree UuidToStringW RpcServerUseProtseqEpW RpcEpUnregister NdrServerCall2 NdrClientCall2 UuidCreate RpcEpResolveBinding RpcBindingSetObject RpcBindingSetAuthInfoW RpcMgmtEpEltInqDone RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin I_RpcGetCurrentCallHandle

shlwapi

UrlUnescapeW PathIsDirectoryW PathFindFileNameW PathIsRelativeW PathCombineW PathCanonicalizeW

samlib

SamEnumerateAliasesInDomain SamQueryInformationUser SamCloseHandle SamEnumerateDomainsInSamServer SamFreeMemory SamEnumerateUsersInDomain SamOpenUser SamLookupDomainInSamServer SamLookupNamesInDomain SamLookupIdsInDomain SamOpenDomain SamConnect SamSetInformationUser SamiChangePasswordUser SamEnumerateGroupsInDomain SamGetGroupsForUser SamGetMembersInGroup SamGetMembersInAlias SamRidToSid SamGetAliasMembership SamOpenGroup SamOpenAlias

secur32

FreeContextBuffer LsaLookupAuthenticationPackage LsaFreeReturnBuffer LsaDeregisterLogonProcess QueryContextAttributesW InitializeSecurityContextW AcquireCredentialsHandleW EnumerateSecurityPackagesW FreeCredentialsHandle DeleteSecurityContext LsaCallAuthenticationPackage LsaConnectUntrusted

shell32

CommandLineToArgvW

user32

SetClipboardViewer DefWindowProcW GetClipboardSequenceNumber OpenClipboard CreateWindowExW ChangeClipboardChain RegisterClassExW TranslateMessage EnumClipboardFormats PostMessageW DispatchMessageW GetKeyboardLayout IsCharAlphaNumericW SendMessageW UnregisterClassW GetMessageW DestroyWindow CloseClipboard GetClipboardData

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

hid

HidD_GetFeature HidD_GetPreparsedData HidD_GetHidGuid HidP_GetCaps HidD_SetFeature HidD_FreePreparsedData HidD_GetAttributes

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

winscard

SCardControl SCardTransmit SCardDisconnect SCardGetAttrib SCardEstablishContext SCardFreeMemory SCardListReadersW SCardReleaseContext SCardGetCardTypeProviderNameW SCardListCardsW SCardConnectW

winsta

WinStationCloseServer WinStationOpenServerW WinStationFreeMemory WinStationConnectW WinStationQueryInformationW WinStationEnumerateW

wldap32

ord145 ord36 ord208 ord41 ord73 ord310 ord13 ord77 ord142 ord54 ord309 ord79 ord304 ord301 ord127 ord26 ord167 ord147 ord27 ord88 ord157 ord14 ord122 ord140 ord203 ord69 ord139 ord97 ord223 ord12 ord113 ord224 ord96 ord133

msasn1

ASN1_CreateEncoder ASN1BERDotVal2Eoid ASN1_CloseEncoder ASN1_CreateDecoder ASN1_FreeEncoded ASN1_CloseModule ASN1_CloseDecoder ASN1_CreateModule

ntdll

RtlIpv6AddressToStringW RtlUnicodeStringToAnsiString RtlFreeAnsiString RtlDowncaseUnicodeString RtlFreeUnicodeString RtlInitUnicodeString RtlEqualUnicodeString NtQueryObject RtlCompressBuffer RtlGetCompressionWorkSpaceSize NtQuerySystemInformation RtlGetCurrentPeb NtQueryInformationProcess RtlCreateUserThread RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlEqualString RtlUpcaseUnicodeString RtlAppendUnicodeStringToString RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtQueryDirectoryObject NtResumeProcess NtOpenDirectoryObject RtlAdjustPrivilege NtSuspendProcess NtTerminateProcess NtQuerySystemEnvironmentValueEx NtSetSystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW

kernel32

SystemTimeToFileTime lstrlenA GetDateFormatW GetSystemTimeAsFileTime ClearCommError CreateRemoteThread WaitForSingleObject CreateProcessW SetConsoleOutputCP GetConsoleOutputCP CreateFileMappingW UnmapViewOfFile MapViewOfFile WriteProcessMemory VirtualProtect InterlockedExchange SetFilePointerEx GetProcessId GetComputerNameW ProcessIdToSessionId VirtualAllocEx VirtualProtectEx VirtualAlloc SetLastError ReadProcessMemory VirtualFreeEx VirtualQueryEx VirtualFree VirtualQuery GetComputerNameExW DeviceIoControl DuplicateHandle OpenProcess GetCurrentProcess ExpandEnvironmentStringsW FindNextFileW FindClose GetCurrentDirectoryW GetFileSizeEx FlushFileBuffers GetFileAttributesW FindFirstFileW lstrlenW GetProcAddress LoadLibraryW GetModuleHandleW FreeLibrary DeleteFileA GetTempPathA GetFileInformationByHandle FileTimeToLocalFileTime GetCurrentDirectoryA GetTempFileNameA SetFilePointer CreateFileA FileTimeToDosDateTime CreateThread LocalFree CloseHandle LocalAlloc GetLastError CreateFileW ReadFile Sleep TerminateThread WriteFile FileTimeToSystemTime GetTimeFormatW GetFullPathNameW GetFullPathNameA HeapReAlloc GetFileSize CreateMutexW HeapCompact SetEndOfFile HeapAlloc QueryPerformanceCounter HeapFree InterlockedCompareExchange UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap FormatMessageA FormatMessageW GetVersionExW WideCharToMultiByte HeapDestroy GetFileAttributesA HeapCreate HeapValidate MultiByteToWideChar GetTempPathW HeapSize LockFileEx GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW OutputDebugStringA GetVersionExA DeleteFileW GetCurrentProcessId GetSystemTime AreFileApisANSI ExitProcess ExitThread RaiseException SetConsoleCtrlHandler SetConsoleTitleW SetFileAttributesW GlobalSize SetHandleInformation CreatePipe InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetEvent CreateEventW GetSystemDirectoryW SetConsoleCursorPosition GetTimeZoneInformation GetStdHandle FillConsoleOutputCharacterW GetConsoleScreenBufferInfo IsWow64Process SetCurrentDirectoryW GetCurrentThread RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetVersion GetModuleHandleA GetCurrentThreadId PurgeComm

msvcrt

calloc __set_app_type _lseeki64 wctomb __setusermatherr isspace mbtowc __mb_cur_max _itoa isleadbyte isxdigit localeconv _snprintf __p__fmode ferror iswctype wcstombs ?terminate@@YAXXZ _write _isatty ungetc _controlfp __badioinfo __pioinfo __p__commode _read isdigit strrchr _amsg_exit _initterm exit _XcptFilter _exit _cexit _errno free _wcsdup _vsnprintf _except_handler3 _wcsicmp vfwprintf _vscwprintf fflush _wfopen wprintf _fileno _iob vwprintf _setmode fclose _stricmp wcsrchr wcschr wcsstr strtoul _wcsnicmp _vscprintf memmove strncmp malloc _msize strcspn realloc fgetws wcstoul strchr wcstol wcsncmp _wcstoui64 towupper _wpgmptr strstr _strcmpi strtol getchar memset memcpy __wgetmainargs

generic

count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=14, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=67, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,

count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=132, productName=VS2008 build 21022, version=21022,

count=51, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=659, id=1, productName=Unmarked objects,

count=1, id=126, version=50727,

count=114, id=137, version=30729,

count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

mimikatz_trunk/Win32/mimilib.dll

IMPHASH 721f5090ab31a091c5b9778028cc974c
SHA256 e60c210687e79347d06f9a144ee84417ba9ac4c1f303720f2fe4509734d670d6
MD5 46e598798bdde4c72e796edcf2317b52
SHA1 e00efa11ab8464e665f2a1d526e94cca5c71d9fa
SHA512 c384fe4cd20dc97b53a26593d30b6c5d8d3665f957019b555bad956cc4e238b50216f47af7fa4ad9bd03d30d323b811aa0e32dcea2e25a9df6855a65dcea9a9d
SSDEEP 384:ZPqreMGv6SqMDjuPRjL9sapJcos+uOiZESsQDygQ2Unn7PAss3sWqWyXO4hMnAl3:lrEdpJLFiq3GO7bs3sdEFyQejil0Tn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

18187

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mimikatz_trunk/Win32/mimilove.exe

IMPHASH 4e1492696c43305d97c6c6a4e8958cdf
SHA256 cc585d962904351ce1d92195b0fc79034dc3b13144f7c7ff24cd9f768b25e9ef
MD5 c67f3497c310c01018f599b3eebae99e
SHA1 d73e52e55b1ad65015886b3a01b1cc27c87e9952
SHA512 1205b5a9a9d2f3fabcce7e53e70e4efce08b21469ae64120beaee67a828d12eeeecddc623b453105ed15990fcc7bbce53175eca6545007f9d68c0aee66e55bc0
SSDEEP 768:LK73LxCEQskxjvDoR8a4Tj9gwF6VLCx2l/:LK5uGRl4f9dqCx2l
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

12594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mimikatz_trunk/Win32/mimispool.dll

IMPHASH 3d9268f54e37cd480a12f0595aa6b437
SHA256 05842de51ede327c0f55df963f6de4e32ab88f43a73b9e0e1d827bc70199eff0
MD5 dab7a18b02399053ba3ff1e568789fce
SHA1 ceee090c9ee8279d6410d8d450d55acb81d34766
SHA512 6dd0ade4112d7ed44c090f81614ed2f1d84cfcb25a45b08d22b3fa74e4e3f9b99f719f8bca9c1f03d13757f38eac072bb4d55e229c478524bf348f76fc3e36dd
SSDEEP 192:I191rqbIcL9uD3nhKlWUEHRl1RtnIDKwIb/DtC0uolZC7:RRgDXhKAUQlftO6tC0uols
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

6411

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mimikatz_trunk/x64/mimidrv.sys

IMPHASH a63c276e82b09fa57509d7958aa9d208
SHA256 d30f51bfd62695df96ba94cde14a7fae466b29ef45252c6ad19d57b4a87ff44e
MD5 3e528207ca374123f63789195a4aedde
SHA1 2616372f708a6fb9665cd28206f4c7de6458f5c5
SHA512 73f83b881e0e329493f6b2ac299ea0b9d9d1b04dc8a4705f78ae3f82b1a3e012db9202079f7e7dff5ad4431d3a8e7e2fb42d3f0963d66ab9a6aa0bf2cfa02c41
SSDEEP 768:6PVvAF3Sz0Kp4TC/ndBK8ipSPnA+vl1qlCGB8zlu0RVHZC5isg:mVvPz0K3EyDlQlHB8zl9RJwisg
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

mimikatz is an open source tool to dump credentials on Windows

PE Signature issue

Digest

97:9e:0f:a7:4f:a1:13:27:40:f5:87:14:d1:0c:c8:89:f0:e9:75:10

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Benjamin Delpy,C=FR

Chains

Jun 12, 2024

Minor OS version

Major OS version

Entry point

45156

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\security\mimikatz\mimidrv\objfre_wnet_amd64\amd64\mimidrv.pdb

Name

.text

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1024B

Virtual Size

651B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mimikatz_trunk/x64/mimikatz.exe

IMPHASH 55ee500bb4bdfc49f27a98ae456d8edf
SHA256 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5
SHA1 e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
SHA512 f00b1ab035aa574c70f6b95b63f676fa75ff8f379f92e85ad5872c358a6bb1ed5417fdd226d421307a48653577ca42aba28103b3b2d7a5c572192d6e5f07e8b3
SSDEEP 24576:0CgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODvsG:0CI7XBE2IuF64rIlmdii
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

825576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

cabinet

ord11 ord14 ord10 ord13

crypt32

cryptdll

MD5Init MD5Final CDLocateCSystem CDGenerateRandomBits CDLocateCheckSum MD5Update

dnsapi

DnsFree DnsQuery_A

fltlib

FilterFindFirst FilterFindNext

mpr

WNetCancelConnection2W WNetAddConnection2W

netapi32

odbc32

ord75 ord9 ord43 ord24 ord31 ord111 ord141 ord13

ole32

CoInitializeEx CoSetProxyBlanket CoTaskMemFree CoUninitialize CoCreateInstance

oleaut32

SysAllocString VariantInit SysFreeString VariantClear

rpcrt4

shlwapi

UrlUnescapeW PathIsDirectoryW PathFindFileNameW PathIsRelativeW PathCombineW PathCanonicalizeW

samlib

secur32

shell32

CommandLineToArgvW

user32

SetClipboardViewer DefWindowProcW GetClipboardSequenceNumber OpenClipboard CreateWindowExW GetClipboardData RegisterClassExW TranslateMessage EnumClipboardFormats PostMessageW DispatchMessageW GetKeyboardLayout IsCharAlphaNumericW SendMessageW UnregisterClassW DestroyWindow CloseClipboard GetMessageW ChangeClipboardChain

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

hid

HidD_GetFeature HidD_GetPreparsedData HidD_GetHidGuid HidD_GetAttributes HidD_SetFeature HidP_GetCaps HidD_FreePreparsedData

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

winscard

SCardReleaseContext SCardListCardsW SCardGetCardTypeProviderNameW SCardListReadersW SCardFreeMemory SCardEstablishContext SCardControl SCardConnectW SCardTransmit SCardDisconnect SCardGetAttrib

winsta

WinStationCloseServer WinStationOpenServerW WinStationFreeMemory WinStationConnectW WinStationQueryInformationW WinStationEnumerateW

wldap32

ord36 ord79 ord145 ord73 ord310 ord208 ord13 ord77 ord142 ord54 ord41 ord309 ord304 ord301 ord127 ord26 ord167 ord147 ord133 ord157 ord88 ord14 ord122 ord140 ord203 ord69 ord139 ord97 ord223 ord12 ord113 ord224 ord96 ord27

msasn1

ASN1_CreateModule ASN1_CloseEncoder ASN1_CreateDecoder ASN1_FreeEncoded ASN1_CloseModule ASN1_CreateEncoder ASN1_CloseDecoder ASN1BERDotVal2Eoid

ntdll

strtol _strcmpi strstr towupper _wcstoui64 wcsncmp wcstol strchr strcspn strncmp memmove _wcsnicmp strtoul wcsstr wcschr wcsrchr _stricmp _vscwprintf _wcsicmp strrchr _vsnprintf log memcmp RtlUnicodeStringToAnsiString RtlFreeAnsiString RtlDowncaseUnicodeString RtlFreeUnicodeString RtlInitUnicodeString RtlEqualUnicodeString NtQueryObject RtlCompressBuffer RtlGetCompressionWorkSpaceSize NtQuerySystemInformation RtlGetCurrentPeb NtQueryInformationProcess RtlCreateUserThread RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlEqualString RtlUpcaseUnicodeString RtlAppendUnicodeStringToString RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtQueryDirectoryObject NtResumeProcess NtOpenDirectoryObject RtlAdjustPrivilege NtSuspendProcess NtTerminateProcess NtQuerySystemEnvironmentValueEx NtSetSystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW RtlIpv6AddressToStringW wcstoul __chkstk

kernel32

lstrlenA GetDateFormatW SystemTimeToFileTime ClearCommError CreateRemoteThread WaitForSingleObject CreateProcessW SetConsoleOutputCP GetConsoleOutputCP CreateFileMappingW UnmapViewOfFile MapViewOfFile WriteProcessMemory VirtualAllocEx VirtualProtectEx RtlVirtualUnwind SetFilePointerEx GetProcessId GetComputerNameW IsWow64Process VirtualAlloc SetLastError ReadProcessMemory VirtualFreeEx VirtualQueryEx VirtualFree VirtualQuery GetComputerNameExW DeviceIoControl DuplicateHandle OpenProcess GetCurrentProcess ExpandEnvironmentStringsW FindNextFileW FindClose GetCurrentDirectoryW GetFileSizeEx FlushFileBuffers GetFileAttributesW FindFirstFileW lstrlenW GetProcAddress LoadLibraryW GetModuleHandleW FreeLibrary DeleteFileA GetTempPathA GetFileInformationByHandle FileTimeToLocalFileTime GetCurrentDirectoryA GetTempFileNameA SetFilePointer CreateFileA FileTimeToDosDateTime CreateThread LocalFree CloseHandle LocalAlloc GetLastError CreateFileW ReadFile TerminateThread WriteFile FileTimeToSystemTime Sleep VirtualProtect WideCharToMultiByte GetTimeFormatW GetFullPathNameW GetFullPathNameA HeapReAlloc GetFileSize CreateMutexW HeapCompact SetEndOfFile HeapAlloc QueryPerformanceCounter HeapFree UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap FormatMessageA FormatMessageW GetVersionExW HeapDestroy GetSystemTimeAsFileTime GetFileAttributesA HeapCreate HeapValidate MultiByteToWideChar GetTempPathW HeapSize LockFileEx GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW OutputDebugStringA GetVersionExA DeleteFileW GetCurrentProcessId GetSystemTime AreFileApisANSI ExitProcess ExitThread RaiseException SetConsoleCtrlHandler SetConsoleTitleW SetFileAttributesW GlobalSize SetHandleInformation CreatePipe InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetEvent CreateEventW GetSystemDirectoryW SetConsoleCursorPosition GetTimeZoneInformation GetStdHandle FillConsoleOutputCharacterW GetConsoleScreenBufferInfo SetCurrentDirectoryW GetCurrentThread ProcessIdToSessionId RtlLookupFunctionEntry RtlCaptureContext TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentThreadId PurgeComm

msvcrt

calloc isdigit _fmode _commode __setusermatherr isspace mbtowc __mb_cur_max isleadbyte isxdigit localeconv _snprintf __set_app_type _itoa wctomb ferror iswctype wcstombs ?terminate@@YAXXZ __badioinfo __pioinfo _read _lseeki64 _write _isatty ungetc _amsg_exit _initterm fclose _setmode vwprintf exit _cexit _exit _XcptFilter __wgetmainargs __C_specific_handler memset memcpy _iob getchar _wpgmptr fgetws realloc _msize malloc _vscprintf _errno free _wcsdup vfwprintf fflush _wfopen wprintf _fileno

generic

count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=62, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,

count=3, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=2, id=132, productName=VS2008 build 21022, version=21022,

count=51, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=670, id=1, productName=Unmarked objects,

count=1, id=126, version=50727,

count=114, id=137, version=30729,

count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

mimikatz_trunk/x64/mimilib.dll

IMPHASH eaa79f1d9e8a00542b09cb462d0658ef
SHA256 aef6ce3014add838cf676b57957d630cd2bb15b0c9193cf349bcffecddbc3623
MD5 67651e9d2da634adedbe216948d5f752
SHA1 0731bd320633a6d1ca7835e2bba2c5ee5429b293
SHA512 88c7de54fd036a3052a49e52a8bb868e1cd67856b8ef1d0f2ad1151f663addf1d9435fb98f83a24cc16ffd832500061b64399c9fe82edcb83404f59daf7bfd47
SSDEEP 768:CsdDjdgqUQv+EAZJimW8ahsNekFkTn5btsnsFfZ9kYeUveejil0g:vU+LuaaQkFkTn5b+sFhW7ejil
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

21640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

generic

count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=55, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=15, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=2, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=132, productName=VS2008 build 21022, version=21022,

count=9, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=119, id=1, productName=Unmarked objects,

count=1, id=126, version=50727,

count=15, id=137, version=30729,

count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

mimikatz_trunk/x64/mimispool.dll

IMPHASH c38ebbf4627ca2303746c77210e5a12e
SHA256 66928c3316a12091995198710e0c537430dacefac1dbe78f12a331e1520142bd
MD5 c6cc0def7d584f431d69126c1cc33a20
SHA1 ea2646a646662909cd2bf5443e6b0030fb3cc6eb
SHA512 17199e1be5d40744ae92d5d1b143645fcd0e413b92696fdaeb673785549bf20f4952a19887fe5c14cddbdfa435320a79044510d0de4e2c52fa26a1d2bfd83826
SSDEEP 192:DGMoIQaZcsBTSWoH6DlI0zPQ4Ib/me0C0uolZC7:VJxgWFlVC50C0uols
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

5864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

mimikatz_trunk/x64/mz64.exe

IMPHASH fc751f775e55aacb1c0c763364369f41
SHA256 b294f94c469f43a78a324b5cfecbde0afb3aa0256bbde06ca2718b8c038a9324
MD5 297b896dbf8d619c61fd947086fce6e8
SHA1 7cb9486abe2317e735bf2e2ddb58992835ac7556
SHA512 0726206509fae1d29612e04e20a4d2f7c32ef1128eeb861f7e24a4feec62e80ffe27864c5caeb60cf7d7e1dd962eaf535ce76751c3619d8f281c7a2c8e5fac44
SSDEEP 24576:rjEObtgfYpGGQakZ6tXEu3hA+w3552NGQ4wE:3EngmstRhA+wJ5e
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

523852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptSetHashParam CryptGetHashParam CryptExportKey CryptAcquireContextW CryptSetKeyParam CryptGetKeyParam CryptReleaseContext CryptDuplicateKey CryptAcquireContextA CryptGetProvParam CryptImportKey SystemFunction007 CryptEncrypt CryptCreateHash CryptGenKey CryptDestroyKey CryptDecrypt CryptDestroyHash CryptHashData CopySid GetLengthSid LsaQueryInformationPolicy LsaOpenPolicy LsaClose CreateWellKnownSid CreateProcessWithLogonW CreateProcessAsUserW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegSetValueExW SystemFunction032 ConvertSidToStringSidW CreateServiceW CloseServiceHandle DeleteService OpenSCManagerW SetServiceObjectSecurity OpenServiceW BuildSecurityDescriptorW QueryServiceObjectSecurity StartServiceW AllocateAndInitializeSid QueryServiceStatusEx FreeSid ControlService IsTextUnicode OpenProcessToken GetTokenInformation LookupAccountNameW LookupAccountSidW DuplicateTokenEx CheckTokenMembership CryptEnumProvidersW ConvertStringSidToSidW LsaFreeMemory SetThreadToken CryptSetProvParam CryptEnumProviderTypesW SystemFunction006 CryptGetUserKey OpenEventLogW GetNumberOfEventLogRecords ClearEventLogW SystemFunction001 CryptDeriveKey SystemFunction005 LsaQueryTrustedDomainInfoByName CryptSignHashW LsaOpenSecret LsaQuerySecret SystemFunction013 LsaRetrievePrivateData LsaEnumerateTrustedDomainsEx LookupPrivilegeValueW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW IsValidSid LookupPrivilegeNameW OpenThreadToken CredFree CredEnumerateW GetSidSubAuthority GetSidSubAuthorityCount SystemFunction025 ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction024 A_SHAUpdate A_SHAFinal A_SHAInit

cabinet

ord11 ord14 ord10 ord13

crypt32

CertGetNameStringW CryptEncodeObject CertEnumSystemStore CryptSignAndEncodeCertificate CertEnumCertificatesInStore CertAddEncodedCertificateToStore CertOpenStore CertFreeCertificateContext CertCloseStore CertSetCertificateContextProperty PFXExportCertStoreEx CryptUnprotectData CryptBinaryToStringW CryptStringToBinaryW CryptProtectData CryptExportPublicKeyInfo CryptAcquireCertificatePrivateKey CertNameToStrW CertGetCertificateContextProperty CertAddCertificateContextToStore CertFindCertificateInStore

cryptdll

CDLocateCSystem MD5Update MD5Final CDGenerateRandomBits CDLocateCheckSum MD5Init

fltlib

FilterFindFirst FilterFindNext

netapi32

DsGetDcNameW NetRemoteTOD NetSessionEnum NetServerGetInfo NetWkstaUserEnum NetStatisticsGet NetShareEnum NetApiBufferFree I_NetServerTrustPasswordsGet I_NetServerReqChallenge I_NetServerAuthenticate2

ole32

CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

SysFreeString VariantInit SysAllocString

rpcrt4

RpcBindingVectorFree UuidToStringW RpcServerUseProtseqEpW NdrServerCall2 NdrClientCall2 UuidCreate RpcEpResolveBinding RpcMgmtEpEltInqDone RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin I_RpcGetCurrentCallHandle RpcEpUnregister RpcBindingFromStringBindingW RpcStringBindingComposeW MesEncodeIncrementalHandleCreate RpcBindingSetAuthInfoExW RpcBindingInqAuthClientW RpcBindingSetOption RpcImpersonateClient RpcBindingFree RpcStringFreeW RpcRevertToSelf MesDecodeIncrementalHandleCreate MesHandleFree MesIncrementalHandleReset NdrMesTypeDecode2 NdrMesTypeAlignSize2 NdrMesTypeFree2 NdrMesTypeEncode2 RpcServerUnregisterIfEx I_RpcBindingInqSecurityContext RpcServerInqBindings RpcServerListen RpcMgmtWaitServerListen RpcEpRegisterW RpcMgmtStopServerListening RpcBindingToStringBindingW RpcServerRegisterIf2 RpcServerRegisterAuthInfoW

shlwapi

PathCombineW PathIsDirectoryW PathCanonicalizeW PathIsRelativeW PathFindFileNameW

samlib

SamGetMembersInGroup SamGetGroupsForUser SamOpenUser SamEnumerateGroupsInDomain SamiChangePasswordUser SamSetInformationUser SamConnect SamOpenDomain SamLookupIdsInDomain SamLookupNamesInDomain SamLookupDomainInSamServer SamRidToSid SamGetMembersInAlias SamEnumerateAliasesInDomain SamGetAliasMembership SamOpenGroup SamOpenAlias SamEnumerateUsersInDomain SamFreeMemory SamEnumerateDomainsInSamServer SamCloseHandle SamQueryInformationUser

secur32

LsaCallAuthenticationPackage DeleteSecurityContext FreeContextBuffer LsaLookupAuthenticationPackage LsaConnectUntrusted LsaFreeReturnBuffer FreeCredentialsHandle EnumerateSecurityPackagesW InitializeSecurityContextW QueryContextAttributesW AcquireCredentialsHandleW LsaDeregisterLogonProcess

shell32

CommandLineToArgvW

user32

GetClipboardSequenceNumber SetClipboardViewer DefWindowProcW DispatchMessageW GetKeyboardLayout IsCharAlphaNumericW EnumClipboardFormats SendMessageW OpenClipboard CreateWindowExW ChangeClipboardChain GetClipboardData RegisterClassExW TranslateMessage PostMessageW DestroyWindow CloseClipboard GetMessageW UnregisterClassW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

hid

HidD_GetPreparsedData HidD_FreePreparsedData HidP_GetCaps HidD_GetFeature HidD_GetAttributes HidD_GetHidGuid HidD_SetFeature

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW

winscard

SCardControl SCardConnectW SCardTransmit SCardDisconnect SCardGetAttrib SCardEstablishContext SCardFreeMemory SCardListReadersW SCardReleaseContext SCardListCardsW SCardGetCardTypeProviderNameW

winsta

WinStationCloseServer WinStationEnumerateW WinStationOpenServerW WinStationFreeMemory WinStationConnectW WinStationQueryInformationW

wldap32

ord122 ord310 ord309 ord304 ord301 ord73 ord127 ord41 ord26 ord157 ord79 ord36 ord145 ord208 ord167 ord147 ord13 ord27 ord77 ord142 ord133 ord88 ord14 ord96 ord224 ord113 ord12 ord223 ord97 ord139 ord69 ord203 ord140 ord54

msasn1

ASN1_CloseEncoder ASN1_CreateDecoder ASN1BERDotVal2Eoid ASN1_CloseDecoder ASN1_CreateModule ASN1_FreeEncoded ASN1_CloseModule ASN1_CreateEncoder

ntdll

RtlGetCurrentPeb RtlGetCompressionWorkSpaceSize NtQueryInformationProcess NtQueryObject RtlEqualUnicodeString RtlInitUnicodeString RtlFreeUnicodeString RtlDowncaseUnicodeString RtlFreeAnsiString RtlUnicodeStringToAnsiString RtlCreateUserThread RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlEqualString RtlUpcaseUnicodeString RtlAppendUnicodeStringToString RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtResumeProcess RtlAdjustPrivilege NtSuspendProcess NtTerminateProcess NtQuerySystemEnvironmentValueEx NtSetSystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW RtlIpv6AddressToStringW RtlCompressBuffer NtQuerySystemInformation

kernel32

SetFilePointerEx FreeEnvironmentStringsW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetModuleFileNameW GetStartupInfoW GetFileType SetStdHandle GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount RtlUnwindEx GetCurrentThreadId GetCPInfo GetOEMCP GetACP IsValidCodePage IsProcessorFeaturePresent IsDebuggerPresent GetCommandLineW GetModuleHandleExW LoadLibraryExW DecodePointer EncodePointer LoadLibraryExA GetProcessId GetComputerNameW ProcessIdToSessionId GetCurrentThread SetCurrentDirectoryW GetConsoleScreenBufferInfo FillConsoleOutputCharacterW GetStdHandle GetTimeZoneInformation SetConsoleCursorPosition GetSystemDirectoryW CreateEventW SetEvent CreatePipe SetHandleInformation GetModuleHandleW GlobalSize GetProcAddress LoadLibraryW FreeLibrary lstrlenA SetConsoleTitleW SetConsoleCtrlHandler RaiseException ExitProcess AreFileApisANSI GetSystemTime GetCurrentProcessId DeleteFileW GetVersionExA OutputDebugStringA DeleteCriticalSection GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA GetDiskFreeSpaceW EnterCriticalSection LockFileEx HeapSize GetTempPathW MultiByteToWideChar HeapValidate HeapCreate GetFileAttributesA LeaveCriticalSection HeapDestroy GetVersionExW FormatMessageW InitializeCriticalSection FormatMessageA GetProcessHeap UnlockFileEx GetTickCount OutputDebugStringW WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile HeapFree QueryPerformanceCounter HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact CreateMutexW GetFileSize HeapReAlloc GetFullPathNameA GetFullPathNameW GetTimeFormatW WideCharToMultiByte GetSystemTimeAsFileTime SystemTimeToFileTime GetDateFormatW lstrlenW PurgeComm ClearCommError CreateRemoteThread WaitForSingleObject SetLastError CreateProcessW SetConsoleOutputCP GetConsoleOutputCP CompareStringW LCMapStringW WriteConsoleW ReadConsoleW SetEnvironmentVariableA GetEnvironmentStringsW CreateFileMappingW UnmapViewOfFile MapViewOfFile WriteProcessMemory VirtualProtect VirtualAllocEx VirtualProtectEx VirtualAlloc ReadProcessMemory VirtualFreeEx VirtualQueryEx VirtualFree VirtualQuery GetComputerNameExW DeviceIoControl DuplicateHandle OpenProcess GetCurrentProcess ExpandEnvironmentStringsW FindNextFileW FindClose GetCurrentDirectoryW GetFileSizeEx FlushFileBuffers GetFileAttributesW FindFirstFileW DeleteFileA GetTempPathA GetFileInformationByHandle FileTimeToLocalFileTime GetCurrentDirectoryA GetTempFileNameA SetFilePointer CreateFileA FileTimeToDosDateTime CreateThread LocalFree CloseHandle LocalAlloc GetLastError CreateFileW ReadFile Sleep TerminateThread WriteFile FileTimeToSystemTime

Sharing

General

Malware Config

Signatures

File Explorer

e20d23481a114d78d961f2e37dc5fd6e.bin

1bae55baa2dfe26ecc9b148bc2c9820ce05e0fbbfe907a3a116aa08546fabe6d.zip

mimikatz_trunk/README.md

mimikatz_trunk/Win32/mimidrv.sys

PE Signature issue

ntoskrnl.exe

fltmgr.sys

generic

mimikatz_trunk/Win32/mimikatz.exe

advapi32

cabinet

crypt32

cryptdll

dnsapi

fltlib

mpr

netapi32

odbc32

ole32

oleaut32

rpcrt4

shlwapi

samlib

secur32

shell32

user32

userenv

version

hid

setupapi

winscard

winsta

wldap32

msasn1

ntdll

kernel32

msvcrt

generic

mimikatz_trunk/Win32/mimilib.dll

advapi32

ntdll

rpcrt4

ole32

kernel32

msvcrt

generic

mimikatz_trunk/Win32/mimilove.exe

advapi32

user32

ntdll

kernel32

msvcrt

generic

mimikatz_trunk/Win32/mimispool.dll

advapi32

userenv

winsta

kernel32

msvcrt

generic

mimikatz_trunk/data.txt

mimikatz_trunk/kiwi_passwords.yar

mimikatz_trunk/mimicom.idl

mimikatz_trunk/x64/mimidrv.sys

PE Signature issue

ntoskrnl.exe

fltmgr.sys

generic

mimikatz_trunk/x64/mimikatz.exe

advapi32

cabinet

crypt32

cryptdll

dnsapi

fltlib