Behavioral task
behavioral1
Sample
2024-10-12_ca0b0ad3d3b76febfac2db2bc11b3b5b_hacktools_icedid_mimikatz.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-10-12_ca0b0ad3d3b76febfac2db2bc11b3b5b_hacktools_icedid_mimikatz.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-12_ca0b0ad3d3b76febfac2db2bc11b3b5b_hacktools_icedid_mimikatz
-
Size
14.3MB
-
MD5
ca0b0ad3d3b76febfac2db2bc11b3b5b
-
SHA1
4c94fa73cc9c4fc932016b5c4529c3ae52ccea29
-
SHA256
769802485eec0d5663a895aa93110462934ce75460050e8e02684c91b3e5e57e
-
SHA512
4db300f4f3c499d3b747c8e215da911f0ad88b029f2699485a7522ad7a0d4f2d6e5b767b70aae3f3d428e1bfffb9ea7a265627e2c8f24ee22ebdf7795565c4f6
-
SSDEEP
196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYPHlTPemknGzwHdOgEPHd9BY:a3jz0E52/iv1E3jz0E5
Malware Config
Signatures
-
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
Processes:
resource yara_rule sample mimikatz -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-10-12_ca0b0ad3d3b76febfac2db2bc11b3b5b_hacktools_icedid_mimikatz -
NSIS installer 1 IoCs
Processes:
resource yara_rule sample nsis_installer_2
Files
-
2024-10-12_ca0b0ad3d3b76febfac2db2bc11b3b5b_hacktools_icedid_mimikatz.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 740KB - Virtual size: 738KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ