mimikatz | 8c1e685c4d74b6d3deb7cb63a3797ddaa51c7fb8451b2531a036ef8ce55219f7

Sharing

Copy URL

Twitter E-mail

General

Target

8c1e685c4d74b6d3deb7cb63a3797ddaa51c7fb8451b2531a036ef8ce55219f7
Size

32KB
MD5

80b4e71fcf1d3e41c95e608ae8258dcd
SHA1

c3bba34c9dbc279e068063d864c18755c000d3f5
SHA256

8c1e685c4d74b6d3deb7cb63a3797ddaa51c7fb8451b2531a036ef8ce55219f7
SHA512

e682ed6b1129586e2af9aae71d85a68e11d0b76e83f8092a9b385de2ac7d2dd5955ad3507b48c4fad3b052125c93a7093a602f8d7a867d3c5ed17da00d9cf646
SSDEEP

768:Klkr5X8k9jW/Y+lIIgxRWE/6yM8bRsnsFE+W8h9Wb7tQpla:gs8fkPW46y5basFOYItQpla

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c1e685c4d74b6d3deb7cb63a3797ddaa51c7fb8451b2531a036ef8ce55219f7

Files

8c1e685c4d74b6d3deb7cb63a3797ddaa51c7fb8451b2531a036ef8ce55219f7
.dll windows:5 windows x64 arch:x64

f91cbae9c276d5a9ad4babafc88ac0df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

CreateRestrictedToken
CreateProcessAsUserW
ConvertSidToStringSidA
IsTextUnicode
OpenProcessToken

ntdll

RtlFreeUnicodeString
RtlStringFromGUID
RtlEqualString

rpcrt4

NdrMesTypeFree2
MesDecodeIncrementalHandleCreate
NdrMesTypeDecode2
MesIncrementalHandleReset
MesHandleFree

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
Sleep
GetCurrentProcess
CloseHandle
FreeLibrary
LoadLibraryW
lstrlenW
GetProcAddress
LocalAlloc
LocalFree
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
RtlVirtualUnwind
GetSystemTimeAsFileTime

msvcrt

_wfopen
fclose
vfwprintf
fflush
memcpy
memset
__C_specific_handler
_XcptFilter
malloc
_initterm
free
_amsg_exit

Exports

Exports

DhcpNewPktHook
DhcpServerCalloutEntry
DnsPluginCleanup
DnsPluginInitialize
DnsPluginQuery
ExtensionApiVersion
InitializeChangeNotify
PasswordChangeNotify
SpLsaModeInitialize
WinDbgExtensionDllInit
coffee
mimikatz
startW

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f91cbae9c276d5a9ad4babafc88ac0df

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ntdll

rpcrt4

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 1024B - Virtual size: 708B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 270B

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 1024B - Virtual size: 708B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 270B