mimikatz | 9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5

General

Target

9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe
Size

1.4MB
MD5

ca4b96adeeacae4a242ebcb8071004fe
SHA1

38ef3d33101316bc546b195cb9006a8388e685ae
SHA256

9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5
SHA512

095a673fd3c99ef69c2341b36ef593ad6361a615bddec2ffe8a86c9bb74342b614a22b64f7506e4d2a21fed3793121b474118d7e401f6a4f7c8230a18fba404d
SSDEEP

24576:szG7MzQX5mTVt8BbOF4zrA2lfI9q17uHGtJfV1ZHH24L:1X6OJlfI9Eu6fZ

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000001211a-1.dat	mimikatz

Executes dropped EXE 1 IoCs

pid	Process
2804	9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe

Loads dropped DLL 2 IoCs

pid	Process
2836	taskeng.exe
2992	Process not Found

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe	9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe
File opened for modification	\??\c:\windows\system32\9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe	9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2564	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1772	2316	9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe	31
PID 2316 wrote to memory of 1772	2316	9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe	31
PID 2316 wrote to memory of 1772	2316	9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe	31
PID 1772 wrote to memory of 2564	1772	cmd.exe	32
PID 1772 wrote to memory of 2564	1772	cmd.exe	32
PID 1772 wrote to memory of 2564	1772	cmd.exe	32
PID 2316 wrote to memory of 2712	2316	9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe	33
PID 2316 wrote to memory of 2712	2316	9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe	33
PID 2316 wrote to memory of 2712	2316	9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe	33
PID 2712 wrote to memory of 2708	2712	cmd.exe	34
PID 2712 wrote to memory of 2708	2712	cmd.exe	34
PID 2712 wrote to memory of 2708	2712	cmd.exe	34
PID 2836 wrote to memory of 2804	2836	taskeng.exe	36
PID 2836 wrote to memory of 2804	2836	taskeng.exe	36
PID 2836 wrote to memory of 2804	2836	taskeng.exe	36
PID 2804 wrote to memory of 492	2804	9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe	7
PID 2804 wrote to memory of 492	2804	9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe	7

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:492

C:\Users\Admin\AppData\Local\Temp\9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe
"C:\Users\Admin\AppData\Local\Temp\9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "MicrosoftEdgeUpdateTaskMachineAgent" /tr "c:\windows\system32\9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe" /sc daily /st 15:14:00 /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeUpdateTaskMachineAgent" /tr "c:\windows\system32\9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe" /sc daily /st 15:14:00 /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /run /tn "MicrosoftEdgeUpdateTaskMachineAgent"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "MicrosoftEdgeUpdateTaskMachineAgent"
    3⤵
    PID:2708

C:\Windows\system32\taskeng.exe
taskeng.exe {5E88DE76-4E55-457B-BD70-766BA69CF48A} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836
- \??\c:\windows\system32\9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe
  c:\windows\system32\9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\System32\9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5.exe

Filesize
1.4MB

MD5
ca4b96adeeacae4a242ebcb8071004fe

SHA1
38ef3d33101316bc546b195cb9006a8388e685ae

SHA256
9c75a42b4dbd0d89a8bfb33bc23def62d4d38a63d6b6226f95b68202298b3ee5

SHA512
095a673fd3c99ef69c2341b36ef593ad6361a615bddec2ffe8a86c9bb74342b614a22b64f7506e4d2a21fed3793121b474118d7e401f6a4f7c8230a18fba404d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads