mimikatz | 67e01b1b04101cc5a8b13d3fc0f2b1cbb5031a8d28c410fea4795c25afa51374

Resubmissions

15-10-2024 21:34

15-10-2024 21:29

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 21:29

Target

beacon_x64.exe
Size

321KB
MD5

85feeb10181592d80c4d9eac0f6b91f7
SHA1

c03946d12c63536cd3e864c82e5da9774efb0826
SHA256

67e01b1b04101cc5a8b13d3fc0f2b1cbb5031a8d28c410fea4795c25afa51374
SHA512

6df2c26b05f5dba889c5c8927ef2531c0c20db383973f358f2b5945a904531f3668dec3740b95d83e2b5475e79062d52a83bd5c36bf1a4c85da287a119ef24bb
SSDEEP

6144:oJLUTvVzfcsqlLGaf3XbxP2Sj7RjxYlh7yzALJfWIEHzYJ1KGbomqFI84pNpvDr:v7M1fLxPRWl7VeCK4XZDrA1k

Score

10^/10

mimikatz

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3976-11-0x00000256CC830000-0x00000256CC87D000-memory.dmp	mimikatz
behavioral1/memory/3976-12-0x00000256CCAF0000-0x00000256CCB41000-memory.dmp	mimikatz
behavioral1/memory/3976-14-0x00000256CCAF0000-0x00000256CCB41000-memory.dmp	mimikatz

Suspicious use of SetThreadContext 2 IoCs

Processes:

beacon_x64.exe

description	pid	Process	procid_target
PID 1556 set thread context of 3976	1556	beacon_x64.exe	105
PID 1556 set thread context of 2332	1556	beacon_x64.exe	106

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description	pid	Process
Token: SeDebugPrivilege	3976	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

beacon_x64.exe

description	pid	Process	procid_target
PID 1556 wrote to memory of 3976	1556	beacon_x64.exe	105
PID 1556 wrote to memory of 3976	1556	beacon_x64.exe	105
PID 1556 wrote to memory of 3976	1556	beacon_x64.exe	105
PID 1556 wrote to memory of 2332	1556	beacon_x64.exe	106
PID 1556 wrote to memory of 2332	1556	beacon_x64.exe	106
PID 1556 wrote to memory of 2332	1556	beacon_x64.exe	106

C:\Users\Admin\AppData\Local\Temp\beacon_x64.exe
"C:\Users\Admin\AppData\Local\Temp\beacon_x64.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\system32\rundll32.exe
  C:\Windows\system32\rundll32.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Windows\system32\rundll32.exe
  C:\Windows\system32\rundll32.exe
  2⤵
  PID:2332

memory/1556-0-0x0000000000760000-0x00000000007AB000-memory.dmp

Filesize
300KB

Download
memory/1556-1-0x00000000007B0000-0x0000000000808000-memory.dmp

Filesize
352KB

Download
memory/1556-4-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1556-5-0x00000000007B0000-0x0000000000808000-memory.dmp

Filesize
352KB

Download
memory/2332-17-0x0000027D5EC40000-0x0000027D5EC9C000-memory.dmp

Filesize
368KB

Download
memory/2332-18-0x0000027D5EF20000-0x0000027D5EF81000-memory.dmp

Filesize
388KB

Download
memory/2332-19-0x0000027D5EF20000-0x0000027D5EF81000-memory.dmp

Filesize
388KB

Download
memory/2332-21-0x0000027D5EF20000-0x0000027D5EF81000-memory.dmp

Filesize
388KB

Download
memory/2332-22-0x0000027D5EF20000-0x0000027D5EF81000-memory.dmp

Filesize
388KB

Download
memory/3976-11-0x00000256CC830000-0x00000256CC87D000-memory.dmp

Filesize
308KB

Download
memory/3976-12-0x00000256CCAF0000-0x00000256CCB41000-memory.dmp

Filesize
324KB

Download
memory/3976-14-0x00000256CCAF0000-0x00000256CCB41000-memory.dmp

Filesize
324KB

Download