mimikatz | 111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7

Analysis

max time kernel
141s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe
Size

3.2MB
MD5

ba1833ddb5a4519077618004e6d8cbbe
SHA1

96077fd81151b779c37514d89b4ddd600fd68bee
SHA256

111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7
SHA512

48f41f450e5d0431f4e9dd87092962327abaecfaf40c33618ae3b00008ec92ba88937a5c6efb8b06795c45467140d9c6052af146f0769faf22f785c578c2da5d
SSDEEP

98304:0uXMX6eXT7YWQGZ0zrBbczGlXMCwTMpAai4lZlc19fBlRaI0VYIm3U6f:vGTjR3ZcVbc6i4lZlQihW

Score

10^/10

mimikatz discovery

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 2 IoCs

resource	yara_rule
behavioral1/memory/2372-15-0x0000000140000000-0x0000000140338670-memory.dmp	mimikatz
behavioral1/memory/2372-17-0x0000000140000000-0x0000000140338670-memory.dmp	mimikatz

Executes dropped EXE 1 IoCs

pid	Process
2768	19142013.9FC

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19142013.9FC

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2768	19142013.9FC
2768	19142013.9FC
2768	19142013.9FC

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2768	2276	111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe	31
PID 2276 wrote to memory of 2768	2276	111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe	31
PID 2276 wrote to memory of 2768	2276	111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe	31
PID 2276 wrote to memory of 2768	2276	111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe	31
PID 2768 wrote to memory of 2372	2768	19142013.9FC	32
PID 2768 wrote to memory of 2372	2768	19142013.9FC	32
PID 2768 wrote to memory of 2372	2768	19142013.9FC	32
PID 2768 wrote to memory of 2372	2768	19142013.9FC	32
PID 2768 wrote to memory of 2372	2768	19142013.9FC	32
PID 2768 wrote to memory of 2372	2768	19142013.9FC	32
PID 2372 wrote to memory of 2564	2372	111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe	34
PID 2372 wrote to memory of 2564	2372	111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe	34
PID 2372 wrote to memory of 2564	2372	111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe	34

C:\Users\Admin\AppData\Local\Temp\111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe
"C:\Users\Admin\AppData\Local\Temp\111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\19142013.9FC
  "C:\Users\Admin\AppData\Local\Temp\\19142013.9FC"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Users\Admin\AppData\Local\Temp\111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe
    "C:\Users\Admin\AppData\Local\Temp\111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2372 -s 268
      4⤵
      PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\19142013.9FC

Filesize
1.6MB

MD5
0e75cd3c3dd46c0209c6d702b236c9e9

SHA1
a9202039ed38c2b3ee6fa17da0a221177113121e

SHA256
933044eb1bf2c65a36513141c968b23b43ac4c3a2c4e7ce2f1d34c3726242681

SHA512
d06922f64a51629388132d6675c83e31e57a358ba1c8428d68964b8aa549e41528bce91c8af1191d140072f7601f9bd3b62c7685e274607ff32c47e496809fa3

Download Submit
memory/2276-0-0x0000000140000000-0x0000000140338670-memory.dmp

Filesize
3.2MB

Download
memory/2276-6-0x0000000140000000-0x0000000140338670-memory.dmp

Filesize
3.2MB

Download
memory/2372-14-0x0000000077440000-0x0000000077442000-memory.dmp

Filesize
8KB

Download
memory/2372-13-0x0000000140000000-0x0000000140338670-memory.dmp

Filesize
3.2MB

Download
memory/2372-15-0x0000000140000000-0x0000000140338670-memory.dmp

Filesize
3.2MB

Download
memory/2372-16-0x00000000773F0000-0x0000000077599000-memory.dmp

Filesize
1.7MB

Download
memory/2372-17-0x0000000140000000-0x0000000140338670-memory.dmp

Filesize
3.2MB

Download
memory/2768-12-0x0000000002B60000-0x0000000002E99000-memory.dmp

Filesize
3.2MB

Download
memory/2768-11-0x0000000002B60000-0x0000000002E99000-memory.dmp

Filesize
3.2MB

Download