mimikatz | 1ace20206ac9356f0f415fb2167d9f60N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

1ace20206ac9356f0f415fb2167d9f60N.exe
Size

1.3MB
MD5

1ace20206ac9356f0f415fb2167d9f60
SHA1

142c0a358c6129d615049e149388539ce2249214
SHA256

a32640d375a5b59df99d7fd408f6ee7c60e7406894ac02b8cf83c6fec2be8aa7
SHA512

8d4d52e218c6e7912438c8a620f69df756adbf2cbf34db906cd338419fb5c258ccb7e76007f3de6fd3d5cb6046bf9c6bfc2bf1da0f8ea09b76e80c5ba48ef664
SSDEEP

24576:zVmhXpKuj24wfrUARHrSc6WTNBEsJ1PeLaf5gxWQJ:BuZ904A1WINusJus5

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ace20206ac9356f0f415fb2167d9f60N.exe

Files

1ace20206ac9356f0f415fb2167d9f60N.exe
.exe windows:5 windows x64 arch:x64

465563294723c727a5ad7bd0c5135ab8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CryptReleaseContext
CryptGenKey
CryptGetProvParam
CryptGetHashParam
CryptImportKey
CryptSetKeyParam
CryptDestroyHash
CryptSetHashParam
CryptHashData
CryptCreateHash
CryptExportKey
CryptDecrypt
SystemFunction007
CryptDuplicateKey
CryptEncrypt
CryptAcquireContextW
CryptGetKeyParam
CryptAcquireContextA
CryptDestroyKey
GetLengthSid
CopySid
LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy
CreateWellKnownSid
CreateProcessAsUserW
CreateProcessWithLogonW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
SystemFunction032
ConvertSidToStringSidW
QueryServiceObjectSecurity
QueryServiceStatusEx
BuildSecurityDescriptorW
OpenServiceW
StartServiceW
FreeSid
ControlService
SetServiceObjectSecurity
DeleteService
AllocateAndInitializeSid
OpenSCManagerW
CloseServiceHandle
CreateServiceW
IsTextUnicode
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
DuplicateTokenEx
CheckTokenMembership
OpenProcessToken
CryptSetProvParam
CryptEnumProvidersW
ConvertStringSidToSidW
LsaFreeMemory
IsValidSid
GetSidSubAuthority
GetSidSubAuthorityCount
SetThreadToken
SystemFunction006
CryptEnumProviderTypesW
CryptGetUserKey
OpenEventLogW
ClearEventLogW
GetNumberOfEventLogRecords
CryptSignHashW
LsaRetrievePrivateData
LsaOpenSecret
LsaQueryTrustedDomainInfoByName
CryptDeriveKey
LsaQuerySecret
SystemFunction001
SystemFunction005
SystemFunction013
LsaEnumerateTrustedDomainsEx
LookupPrivilegeValueW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
OpenThreadToken
LookupPrivilegeNameW
EqualSid
CredFree
CredEnumerateW
SystemFunction025
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction024
CredUnmarshalCredentialW
CredIsMarshaledCredentialW
A_SHAUpdate
A_SHAInit
A_SHAFinal

cabinet

ord14
ord10
ord13
ord11

crypt32

CertGetNameStringW
CryptQueryObject
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertEnumSystemStore
CertAddEncodedCertificateToStore
CertFreeCertificateContext
CertCloseStore
PFXExportCertStoreEx
CertSetCertificateContextProperty
CertOpenStore
CryptUnprotectData
CryptBinaryToStringW
CryptStringToBinaryA
CryptBinaryToStringA
CryptStringToBinaryW
CryptAcquireCertificatePrivateKey
CryptExportPublicKeyInfo
CryptFindOIDInfo
CryptSignAndEncodeCertificate
CertNameToStrW
CryptEncodeObject
CertFindCertificateInStore
CertGetCertificateContextProperty
CryptProtectData
CryptDecodeObjectEx

cryptdll

CDGenerateRandomBits
MD5Init
MD5Update
CDLocateCheckSum
MD5Final
CDLocateCSystem

dnsapi

DnsQuery_A
DnsFree

fltlib

FilterFindNext
FilterFindFirst

netapi32

NetRemoteTOD
NetSessionEnum
NetStatisticsGet
NetShareEnum
DsEnumerateDomainTrustsW
DsGetDcNameW
NetApiBufferFree
NetWkstaUserEnum
NetServerGetInfo
I_NetServerAuthenticate2
I_NetServerReqChallenge
I_NetServerTrustPasswordsGet

ole32

CoTaskMemFree
CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

VariantInit
SysFreeString
SysAllocString

rpcrt4

RpcMgmtEpEltInqDone
RpcMgmtEpEltInqNextW
RpcEpResolveBinding
RpcMgmtEpEltInqBegin
UuidCreate
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcStringFreeW
MesHandleFree
RpcImpersonateClient
RpcRevertToSelf
MesEncodeIncrementalHandleCreate
MesDecodeIncrementalHandleCreate
RpcBindingFree
MesIncrementalHandleReset
NdrMesTypeEncode2
NdrMesTypeDecode2
RpcBindingSetAuthInfoW
NdrMesTypeFree2
NdrMesTypeAlignSize2
RpcBindingVectorFree
RpcServerUseProtseqEpW
RpcServerUnregisterIfEx
RpcBindingToStringBindingW
UuidToStringW
RpcServerRegisterIf2
RpcMgmtWaitServerListen
RpcServerListen
RpcServerRegisterAuthInfoW
RpcEpUnregister
RpcEpRegisterW
RpcServerInqBindings
RpcMgmtStopServerListening
I_RpcBindingInqSecurityContext
NdrClientCall2
NdrServerCall2
I_RpcGetCurrentCallHandle

shlwapi

PathCombineW
PathCanonicalizeW
PathIsRelativeW
PathFindFileNameW
PathIsDirectoryW

samlib

SamConnect
SamLookupIdsInDomain
SamiChangePasswordUser
SamOpenUser
SamLookupDomainInSamServer
SamFreeMemory
SamQueryInformationUser
SamSetInformationUser
SamOpenGroup
SamEnumerateDomainsInSamServer
SamRidToSid
SamOpenAlias
SamGetAliasMembership
SamEnumerateGroupsInDomain
SamGetMembersInGroup
SamGetMembersInAlias
SamGetGroupsForUser
SamOpenDomain
SamLookupNamesInDomain
SamEnumerateUsersInDomain
SamEnumerateAliasesInDomain
SamCloseHandle

secur32

LsaFreeReturnBuffer
FreeContextBuffer
LsaCallAuthenticationPackage
LsaDeregisterLogonProcess
LsaConnectUntrusted
DeleteSecurityContext
AcquireCredentialsHandleW
InitializeSecurityContextW
FreeCredentialsHandle
LsaLookupAuthenticationPackage
EnumerateSecurityPackagesW
QueryContextAttributesW

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW
UnregisterClassW
GetClipboardData
GetClipboardSequenceNumber
TranslateMessage
EnumClipboardFormats
CloseClipboard
ChangeClipboardChain
DispatchMessageW
OpenClipboard
RegisterClassExW
SendMessageW
GetMessageW
DefWindowProcW
PostMessageW
DestroyWindow
SetClipboardViewer
CreateWindowExW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

hid

HidD_FreePreparsedData
HidD_GetPreparsedData
HidD_GetAttributes
HidD_GetFeature
HidD_SetFeature
HidP_GetCaps
HidD_GetHidGuid

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces

winscard

SCardDisconnect
SCardConnectW
SCardControl
SCardListReadersW
SCardGetCardTypeProviderNameW
SCardListCardsW
SCardEstablishContext
SCardGetAttrib
SCardFreeMemory
SCardTransmit
SCardReleaseContext

winsta

WinStationEnumerateW
WinStationConnectW
WinStationFreeMemory
WinStationCloseServer
WinStationQueryInformationW
WinStationOpenServerW

wldap32

ord96
ord208
ord73
ord13
ord36
ord79
ord41
ord142
ord77
ord145
ord54
ord301
ord304
ord309
ord167
ord133
ord127
ord26
ord27
ord147
ord157
ord224
ord203
ord88
ord14
ord140
ord113
ord223
ord97
ord122
ord139
ord12
ord69
ord310

msasn1

ASN1_CloseModule
ASN1_FreeEncoded
ASN1BERDotVal2Eoid
ASN1_CreateModule
ASN1_CloseEncoder
ASN1_CreateEncoder
ASN1_CreateDecoder
ASN1_CloseDecoder

ntdll

NtQuerySystemInformation
NtQueryInformationProcess
NtQueryObject
RtlInitUnicodeString
RtlEqualUnicodeString
RtlDowncaseUnicodeString
RtlFreeUnicodeString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlGetCurrentPeb
RtlCreateUserThread
RtlGUIDFromString
RtlStringFromGUID
NtCompareTokens
RtlGetNtVersionNumbers
RtlEqualString
RtlAppendUnicodeStringToString
RtlUpcaseUnicodeString
RtlAnsiStringToUnicodeString
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
NtResumeProcess
RtlAdjustPrivilege
NtTerminateProcess
NtSuspendProcess
NtSetSystemEnvironmentValueEx
NtQuerySystemEnvironmentValueEx
NtEnumerateSystemEnvironmentValuesEx
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
RtlGetCompressionWorkSpaceSize
RtlCompressBuffer

kernel32

IsValidCodePage
FindFirstFileExW
GetStringTypeW
SetStdHandle
GetConsoleMode
GetConsoleCP
LCMapStringW
CompareStringW
GetFileType
GetACP
GetModuleFileNameW
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
TerminateProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetCurrentThreadId
LoadLibraryExA
SetFilePointerEx
GetProcessId
GetComputerNameW
ProcessIdToSessionId
GetCurrentThread
SetConsoleCursorPosition
SetCurrentDirectoryW
FillConsoleOutputCharacterW
GetTimeZoneInformation
GetSystemDirectoryW
GetStdHandle
GetConsoleScreenBufferInfo
SetEvent
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreatePipe
SetHandleInformation
GlobalSize
SetConsoleCtrlHandler
SetFileAttributesW
ExitProcess
RaiseException
ExitThread
GetTickCount
QueryPerformanceCounter
FormatMessageA
GetSystemTime
GetProcessHeap
GetCurrentProcessId
GetFileSize
LockFileEx
CreateFileMappingA
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
GetSystemInfo
HeapReAlloc
DeleteFileW
GetVersionExA
WaitForSingleObjectEx
LoadLibraryA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
MultiByteToWideChar
HeapSize
HeapValidate
GetVersionExW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
GetDateFormatW
GetSystemTimeAsFileTime
WideCharToMultiByte
SystemTimeToFileTime
GetTimeFormatW
lstrlenA
ClearCommError
PurgeComm
CreateRemoteThread
WaitForSingleObject
SetLastError
CreateProcessW
SetConsoleOutputCP
GetConsoleOutputCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
ReadConsoleW
GetOEMCP
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
VirtualQueryEx
VirtualQuery
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
VirtualFree
VirtualProtect
RtlUnwind
WriteProcessMemory
GetComputerNameExW
DeviceIoControl
OpenProcess
DuplicateHandle
GetCurrentProcess
FlushFileBuffers
GetCurrentDirectoryW
GetFileAttributesW
FindClose
ExpandEnvironmentStringsW
FindNextFileW
GetFileSizeEx
FindFirstFileW
lstrlenW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
FileTimeToDosDateTime
GetTempFileNameA
FileTimeToLocalFileTime
DeleteFileA
CreateFileA
GetTempPathA
GetFileInformationByHandle
GetCurrentDirectoryA
SetFilePointer
LocalFree
CreateThread
CloseHandle
TerminateThread
GetLastError
Sleep
CreateFileW
LocalAlloc
WriteFile
ReadFile
FileTimeToSystemTime

Sections

.text
Size: 872KB - Virtual size: 872KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 412KB - Virtual size: 412KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

465563294723c727a5ad7bd0c5135ab8

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

cabinet

crypt32

cryptdll

dnsapi

fltlib

netapi32

ole32

oleaut32

rpcrt4

shlwapi

samlib

secur32

shell32

user32

userenv

version

hid

setupapi

winscard

winsta

wldap32

msasn1

ntdll

kernel32

Sections

.text Size: 872KB - Virtual size: 872KB

.rdata Size: 412KB - Virtual size: 412KB

.data Size: 25KB - Virtual size: 32KB

.pdata Size: 29KB - Virtual size: 29KB

_RDATA Size: 512B - Virtual size: 148B

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 872KB - Virtual size: 872KB

.rdata
Size: 412KB - Virtual size: 412KB

.data
Size: 25KB - Virtual size: 32KB

.pdata
Size: 29KB - Virtual size: 29KB

_RDATA
Size: 512B - Virtual size: 148B

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 7KB - Virtual size: 7KB