mimikatz | mimikatz[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mimikatz.exe
Size 1.2MB
Sample240819-prswaatgrd
SHA256 92804faaab2175dc501d73e814663058c78c0a042675a8937266357bcfb96c50
MD5 e930b05efe23891d19bc354a4209be3e
SHA1 d1f7832035c3e8a73cc78afd28cfd7f4cece6d20
SHA512 a7a59176ca275d5d5ea6547108907bbe8ddbf3489308b3d6efe571b685de7e6263d36d6580abe9587a7f77adc22d3b7b164ad42845b6c110b794eaba7ab47ec6
SSDEEP 24576:zLrEjqXg4NiXcmHVjIhlIyEeQ37uV3Ugmf4Yl0Q0V7FCR:zLZo1jFyjFJhmf4YlHWk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

File Explorer

mimikatz.exe

.exe 1.2MB

mimikatz.exe

IMPHASH 1355327f6ca3430b3ddbe6e0acda71ea
SHA256 92804faaab2175dc501d73e814663058c78c0a042675a8937266357bcfb96c50
MD5 e930b05efe23891d19bc354a4209be3e
SHA1 d1f7832035c3e8a73cc78afd28cfd7f4cece6d20
SHA512 a7a59176ca275d5d5ea6547108907bbe8ddbf3489308b3d6efe571b685de7e6263d36d6580abe9587a7f77adc22d3b7b164ad42845b6c110b794eaba7ab47ec6
SSDEEP 24576:zLrEjqXg4NiXcmHVjIhlIyEeQ37uV3Ugmf4Yl0Q0V7FCR:zLZo1jFyjFJhmf4YlHWk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

mimikatz is an open source tool to dump credentials on Windows

Digest

71:c1:40:fa:4c:5c:fe:12:62:34:82:3c:fb:4a:ad:51:e6:ce:1b:6a:cf:77:d5:6e:f7:a9:98:ef:68:47:f3:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Chains

Feb 29, 2020

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Digest

2e:a0:f6:10:c7:a6:cc:b0:ae:92:c2:cb:a0:01:ff:09:a5:13:55:ed

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Chains

Feb 29, 2020

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 29, 2015 - Jun 9, 2027

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Serial Number

10:a9:2b:2a:c8:aa:84:76:b6:c7:23:2e:c0:a9:e6:fa

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 5, 2019 - Dec 4, 2020

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 8, 2016 - May 30, 2027

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 29, 2015 - Jun 9, 2027

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Serial Number

10:a9:2b:2a:c8:aa:84:76:b6:c7:23:2e:c0:a9:e6:fa

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 5, 2019 - Dec 4, 2020

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 8, 2016 - May 30, 2027

Minor OS version

Major OS version

Entry point

773388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptSetHashParam CryptGetHashParam CryptExportKey CryptAcquireContextW CryptSetKeyParam CryptGetKeyParam CryptReleaseContext CryptDuplicateKey CryptAcquireContextA CryptGetProvParam CryptImportKey SystemFunction007 CryptEncrypt CryptCreateHash CryptGenKey CryptDestroyKey CryptDecrypt CryptDestroyHash CryptHashData CopySid GetLengthSid LsaQueryInformationPolicy LsaOpenPolicy LsaClose CreateWellKnownSid CreateProcessWithLogonW CreateProcessAsUserW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegSetValueExW SystemFunction032 ConvertSidToStringSidW CreateServiceW CloseServiceHandle DeleteService OpenSCManagerW SetServiceObjectSecurity OpenServiceW BuildSecurityDescriptorW QueryServiceObjectSecurity StartServiceW AllocateAndInitializeSid QueryServiceStatusEx FreeSid ControlService IsTextUnicode OpenProcessToken GetTokenInformation LookupAccountNameW LookupAccountSidW DuplicateTokenEx CheckTokenMembership CryptSetProvParam CryptEnumProvidersW ConvertStringSidToSidW LsaFreeMemory GetSidSubAuthority GetSidSubAuthorityCount IsValidSid SetThreadToken CryptEnumProviderTypesW SystemFunction006 CryptGetUserKey OpenEventLogW GetNumberOfEventLogRecords ClearEventLogW SystemFunction001 CryptDeriveKey SystemFunction005 LsaQueryTrustedDomainInfoByName CryptSignHashW LsaOpenSecret LsaQuerySecret SystemFunction013 LsaRetrievePrivateData LsaEnumerateTrustedDomainsEx LookupPrivilegeValueW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW LookupPrivilegeNameW OpenThreadToken CredFree CredEnumerateW SystemFunction025 ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction024 CredIsMarshaledCredentialW CredUnmarshalCredentialW A_SHAFinal A_SHAInit A_SHAUpdate

cabinet

ord11 ord14 ord10 ord13

crypt32

CertFindCertificateInStore CertEnumSystemStore CertEnumCertificatesInStore CertAddCertificateContextToStore CryptDecodeObjectEx CertAddEncodedCertificateToStore CertOpenStore CertFreeCertificateContext CertCloseStore CertSetCertificateContextProperty PFXExportCertStoreEx CryptUnprotectData CryptBinaryToStringW CryptBinaryToStringA CryptStringToBinaryW CryptExportPublicKeyInfo CryptFindOIDInfo CryptAcquireCertificatePrivateKey CertNameToStrW CryptStringToBinaryA CertGetCertificateContextProperty CryptSignAndEncodeCertificate CryptEncodeObject CryptProtectData CryptQueryObject CertGetNameStringW

cryptdll

MD5Init MD5Update MD5Final CDLocateCSystem CDGenerateRandomBits CDLocateCheckSum

dnsapi

DnsFree DnsQuery_A

fltlib

FilterFindFirst FilterFindNext

netapi32

NetServerGetInfo NetStatisticsGet NetShareEnum DsEnumerateDomainTrustsW DsGetDcNameW NetApiBufferFree NetRemoteTOD NetSessionEnum NetWkstaUserEnum I_NetServerAuthenticate2 I_NetServerTrustPasswordsGet I_NetServerReqChallenge

ole32

CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantInit SysFreeString SysAllocString

rpcrt4

RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin I_RpcGetCurrentCallHandle NdrClientCall2 RpcMgmtEpEltInqDone RpcBindingFromStringBindingW RpcStringBindingComposeW MesEncodeIncrementalHandleCreate RpcBindingSetAuthInfoExW RpcBindingInqAuthClientW RpcBindingSetOption RpcImpersonateClient RpcBindingFree RpcStringFreeW RpcRevertToSelf MesDecodeIncrementalHandleCreate MesHandleFree MesIncrementalHandleReset NdrMesTypeDecode2 NdrMesTypeAlignSize2 NdrMesTypeFree2 NdrMesTypeEncode2 RpcServerUnregisterIfEx I_RpcBindingInqSecurityContext RpcServerInqBindings RpcServerListen RpcMgmtWaitServerListen RpcEpRegisterW RpcMgmtStopServerListening RpcBindingToStringBindingW RpcServerRegisterIf2 RpcServerRegisterAuthInfoW RpcBindingVectorFree UuidToStringW RpcServerUseProtseqEpW RpcEpUnregister NdrServerCall2 RpcEpResolveBinding UuidCreate

shlwapi

PathIsDirectoryW PathCanonicalizeW PathCombineW PathFindFileNameW PathIsRelativeW

samlib

SamEnumerateGroupsInDomain SamiChangePasswordUser SamSetInformationUser SamGetGroupsForUser SamConnect SamGetMembersInGroup SamRidToSid SamGetMembersInAlias SamEnumerateAliasesInDomain SamGetAliasMembership SamOpenGroup SamQueryInformationUser SamCloseHandle SamEnumerateDomainsInSamServer SamFreeMemory SamEnumerateUsersInDomain SamOpenUser SamLookupDomainInSamServer SamLookupNamesInDomain SamLookupIdsInDomain SamOpenDomain SamOpenAlias

secur32

QueryContextAttributesW FreeContextBuffer LsaConnectUntrusted LsaLookupAuthenticationPackage LsaDeregisterLogonProcess DeleteSecurityContext LsaCallAuthenticationPackage FreeCredentialsHandle EnumerateSecurityPackagesW AcquireCredentialsHandleW InitializeSecurityContextW LsaFreeReturnBuffer

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW GetKeyboardLayout DispatchMessageW DefWindowProcW SetClipboardViewer SendMessageW GetClipboardSequenceNumber OpenClipboard CreateWindowExW ChangeClipboardChain GetClipboardData RegisterClassExW TranslateMessage EnumClipboardFormats PostMessageW UnregisterClassW GetMessageW CloseClipboard DestroyWindow

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

hid

HidD_GetFeature HidD_GetPreparsedData HidD_GetHidGuid HidD_GetAttributes HidD_FreePreparsedData HidP_GetCaps HidD_SetFeature

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

winscard

SCardControl SCardTransmit SCardDisconnect SCardGetAttrib SCardEstablishContext SCardFreeMemory SCardListReadersW SCardReleaseContext SCardGetCardTypeProviderNameW SCardListCardsW SCardConnectW

winsta

WinStationCloseServer WinStationOpenServerW WinStationFreeMemory WinStationConnectW WinStationQueryInformationW WinStationEnumerateW

wldap32

ord122 ord14 ord88 ord157 ord133 ord27 ord147 ord167 ord26 ord127 ord224 ord113 ord309 ord54 ord142 ord77 ord13 ord208 ord145 ord36 ord79 ord41 ord73 ord310 ord203 ord69 ord139 ord97 ord223 ord304 ord12 ord96 ord301 ord140

msasn1

ASN1_CreateModule ASN1BERDotVal2Eoid ASN1_CloseEncoder ASN1_CreateDecoder ASN1_FreeEncoded ASN1_CloseModule ASN1_CreateEncoder ASN1_CloseDecoder

ntdll

RtlFreeAnsiString RtlDowncaseUnicodeString RtlFreeUnicodeString RtlInitUnicodeString RtlEqualUnicodeString NtQueryObject RtlCompressBuffer RtlGetCompressionWorkSpaceSize NtQuerySystemInformation RtlGetCurrentPeb NtQueryInformationProcess RtlUnicodeStringToAnsiString RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlEqualString RtlUpcaseUnicodeString RtlAppendUnicodeStringToString RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtResumeProcess RtlAdjustPrivilege NtSuspendProcess NtTerminateProcess NtQuerySystemEnvironmentValueEx RtlCreateUserThread NtSetSystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW RtlIpv6AddressToStringW

kernel32

GetFullPathNameA GetFullPathNameW GetTimeFormatW WideCharToMultiByte GetSystemTimeAsFileTime SystemTimeToFileTime GetDateFormatW PurgeComm ClearCommError RtlVirtualUnwind SetFilePointerEx GetProcessId CreateRemoteThread WaitForSingleObject SetLastError CreateProcessW SetConsoleOutputCP GetConsoleOutputCP CreateFileMappingW UnmapViewOfFile MapViewOfFile WriteProcessMemory VirtualAllocEx VirtualProtectEx VirtualAlloc ReadProcessMemory VirtualFreeEx VirtualQueryEx VirtualFree VirtualQuery GetComputerNameExW DeviceIoControl DuplicateHandle OpenProcess GetCurrentProcess ExpandEnvironmentStringsW FindNextFileW FindClose GetCurrentDirectoryW GetFileSizeEx FlushFileBuffers GetFileAttributesW FindFirstFileW lstrlenW DeleteFileA GetTempPathA GetFileInformationByHandle FileTimeToLocalFileTime GetCurrentDirectoryA GetTempFileNameA SetFilePointer CreateFileA FileTimeToDosDateTime CreateThread LocalFree CloseHandle LocalAlloc HeapReAlloc CreateFileW ReadFile TerminateThread WriteFile FileTimeToSystemTime Sleep VirtualProtect CreateMutexW HeapCompact SetEndOfFile FreeLibrary HeapAlloc QueryPerformanceCounter HeapFree UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap FormatMessageA LoadLibraryW GetFileSize FormatMessageW GetVersionExW HeapDestroy GetFileAttributesA HeapCreate HeapValidate MultiByteToWideChar GetTempPathW GetProcAddress HeapSize LockFileEx GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW OutputDebugStringA GetVersionExA DeleteFileW GetCurrentProcessId GetSystemTime AreFileApisANSI ExitProcess RaiseException SetConsoleCtrlHandler SetConsoleTitleW lstrlenA GlobalSize GetModuleHandleW SetHandleInformation CreatePipe InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetEvent CreateEventW GetSystemDirectoryW GetCurrentThreadId SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlCaptureContext GetLastError RtlLookupFunctionEntry SetConsoleCursorPosition GetTimeZoneInformation GetStdHandle FillConsoleOutputCharacterW GetConsoleScreenBufferInfo GetComputerNameW ProcessIdToSessionId GetCurrentThread SetCurrentDirectoryW

msvcrt

isspace isdigit calloc mbtowc _lseeki64 _write isleadbyte isxdigit localeconv _snprintf _itoa wctomb ferror iswctype wcstombs _isatty ungetc ?terminate@@YAXXZ __badioinfo __pioinfo _read log __mb_cur_max vwprintf __set_app_type _fmode _commode _errno free _wcsdup _vsnprintf strrchr _wcsicmp vfwprintf _vscwprintf fflush _wfopen wprintf _fileno _iob memcmp _setmode fclose _stricmp wcsrchr wcschr strtoul _wcsnicmp wcsstr _vscprintf memmove strncmp malloc _msize strcspn realloc fgetws wcstoul wcstol towupper _wpgmptr strstr strchr _wcstoui64 wcsncmp getchar memcpy memset __C_specific_handler __wgetmainargs _XcptFilter _exit _cexit exit _initterm _amsg_exit __setusermatherr

generic

count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=63, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,

count=2, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=2, id=132, productName=VS2008 build 21022, version=21022,

count=47, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=634, id=1, productName=Unmarked objects,

count=1, id=126, version=50727,

count=99, id=137, version=30729,

count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,