mimikatz | 111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7

Analysis

max time kernel
138s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe
Size

3.2MB
MD5

ba1833ddb5a4519077618004e6d8cbbe
SHA1

96077fd81151b779c37514d89b4ddd600fd68bee
SHA256

111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7
SHA512

48f41f450e5d0431f4e9dd87092962327abaecfaf40c33618ae3b00008ec92ba88937a5c6efb8b06795c45467140d9c6052af146f0769faf22f785c578c2da5d
SSDEEP

98304:0uXMX6eXT7YWQGZ0zrBbczGlXMCwTMpAai4lZlc19fBlRaI0VYIm3U6f:vGTjR3ZcVbc6i4lZlQihW

Score

10^/10

mimikatz discovery

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 2 IoCs

resource	yara_rule
behavioral2/memory/4492-11-0x0000000140000000-0x0000000140338670-memory.dmp	mimikatz
behavioral2/memory/4492-13-0x0000000140000000-0x0000000140338670-memory.dmp	mimikatz

Executes dropped EXE 1 IoCs

pid	Process
1988	C50DA584.9FC

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C50DA584.9FC

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1988	C50DA584.9FC
1988	C50DA584.9FC
1988	C50DA584.9FC

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 1988	3872	111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe	85
PID 3872 wrote to memory of 1988	3872	111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe	85
PID 3872 wrote to memory of 1988	3872	111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe	85
PID 1988 wrote to memory of 4492	1988	C50DA584.9FC	91
PID 1988 wrote to memory of 4492	1988	C50DA584.9FC	91
PID 1988 wrote to memory of 4492	1988	C50DA584.9FC	91
PID 1988 wrote to memory of 4492	1988	C50DA584.9FC	91

C:\Users\Admin\AppData\Local\Temp\111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe
"C:\Users\Admin\AppData\Local\Temp\111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Local\Temp\C50DA584.9FC
  "C:\Users\Admin\AppData\Local\Temp\\C50DA584.9FC"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe
    "C:\Users\Admin\AppData\Local\Temp\111c98deaa0f1ee1a7d8a8a64ef28a1774955128844c7fe6e8a2df777cd538c7.exe"
    3⤵
    PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C50DA584.9FC

Filesize
1.6MB

MD5
f80c180a0efc3a3897b03e80083d2a5e

SHA1
580b2487b10fb5682903c2a39ed78278d1646da9

SHA256
8836694cb2627d0d1286c2dda8fe5e6bad678768ed993c8829a13f9261fabf95

SHA512
6df815d89886fa578e61e7a5544e0c4ed72b5bb092b5d6c7ba3dd8cff4daf897717dd5f940770533e255b1aa8b65d86112578d9a565c5b63a4324660b77c33c7

Download Submit
memory/3872-0-0x0000000140000000-0x0000000140338670-memory.dmp

Filesize
3.2MB

Download
memory/3872-4-0x0000000140000000-0x0000000140338670-memory.dmp

Filesize
3.2MB

Download
memory/4492-9-0x0000000140000000-0x0000000140338670-memory.dmp

Filesize
3.2MB

Download
memory/4492-10-0x00007FFB23B70000-0x00007FFB23B72000-memory.dmp

Filesize
8KB

Download
memory/4492-11-0x0000000140000000-0x0000000140338670-memory.dmp

Filesize
3.2MB

Download
memory/4492-12-0x00007FFB23AD0000-0x00007FFB23CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4492-13-0x0000000140000000-0x0000000140338670-memory.dmp

Filesize
3.2MB

Download