mimikatz | dcb3ab43a6ea430667bd1b5283ef0db79b2349031c0e91b3b4e1403b24c98d80

General

Target

dcb3ab43a6ea430667bd1b5283ef0db79b2349031c0e91b3b4e1403b24c98d80.exe
Size

1.6MB
MD5

9ff9e0b9601d48a256409e5831a086be
SHA1

b004eb0dae356da360b3efe55c8b281e0dc93b64
SHA256

dcb3ab43a6ea430667bd1b5283ef0db79b2349031c0e91b3b4e1403b24c98d80
SHA512

da597b90a515a538a29519e7491afb270f3b32157a5fc289467198c0836436acda056ae27969e56f83462d6fa20aa3e24348bd462e39e73d50b50328bc302f1d
SSDEEP

6144:6VXtCGgA9T7uUVaIvbXCRxo2HHVKwIsgKNEYcevyODHqwsfPuu4TJ+voESuxDnxS:6VW+mu3wpgFl+98rOJx

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3808-26-0x000001C4C1510000-0x000001C4C155D000-memory.dmp	mimikatz

Suspicious use of SetThreadContext 5 IoCs

Processes:

werfault.exe

description	pid	process	target process
PID 2944 set thread context of 3932	2944	werfault.exe	rundll32.exe
PID 2944 set thread context of 4752	2944	werfault.exe	rundll32.exe
PID 2944 set thread context of 3808	2944	werfault.exe	rundll32.exe
PID 2944 set thread context of 2996	2944	werfault.exe	rundll32.exe
PID 2944 set thread context of 1180	2944	werfault.exe	rundll32.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

1316 ipconfig.exe

pid	process
1316	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

werfault.exerundll32.exerundll32.exe

pid	process
2944	werfault.exe
2944	werfault.exe
3808	rundll32.exe
3808	rundll32.exe
3808	rundll32.exe
3808	rundll32.exe
3808	rundll32.exe
3808	rundll32.exe
2996	rundll32.exe
2996	rundll32.exe
2944	werfault.exe
2944	werfault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

rundll32.exerundll32.exe

description pid process

Token: SeDebugPrivilege 3808 rundll32.exe
Token: SeDebugPrivilege 2996 rundll32.exe

description	pid	process
Token: SeDebugPrivilege	3808	rundll32.exe
Token: SeDebugPrivilege	2996	rundll32.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

werfault.exerundll32.exerundll32.exelsass.exe

description	pid	process	target process
PID 2944 wrote to memory of 3932	2944	werfault.exe	rundll32.exe
PID 2944 wrote to memory of 3932	2944	werfault.exe	rundll32.exe
PID 2944 wrote to memory of 3932	2944	werfault.exe	rundll32.exe
PID 3932 wrote to memory of 1316	3932	rundll32.exe	ipconfig.exe
PID 3932 wrote to memory of 1316	3932	rundll32.exe	ipconfig.exe
PID 2944 wrote to memory of 4752	2944	werfault.exe	rundll32.exe
PID 2944 wrote to memory of 4752	2944	werfault.exe	rundll32.exe
PID 2944 wrote to memory of 4752	2944	werfault.exe	rundll32.exe
PID 2944 wrote to memory of 1700	2944	werfault.exe	cmd.exe
PID 2944 wrote to memory of 1700	2944	werfault.exe	cmd.exe
PID 2944 wrote to memory of 3808	2944	werfault.exe	rundll32.exe
PID 2944 wrote to memory of 3808	2944	werfault.exe	rundll32.exe
PID 2944 wrote to memory of 3808	2944	werfault.exe	rundll32.exe
PID 2944 wrote to memory of 2996	2944	werfault.exe	rundll32.exe
PID 2944 wrote to memory of 2996	2944	werfault.exe	rundll32.exe
PID 2944 wrote to memory of 2996	2944	werfault.exe	rundll32.exe
PID 2996 wrote to memory of 664	2996	rundll32.exe	lsass.exe
PID 2996 wrote to memory of 664	2996	rundll32.exe	lsass.exe
PID 664 wrote to memory of 2572	664	lsass.exe	sysmon.exe
PID 2944 wrote to memory of 1180	2944	werfault.exe	rundll32.exe
PID 2944 wrote to memory of 1180	2944	werfault.exe	rundll32.exe
PID 2944 wrote to memory of 1180	2944	werfault.exe	rundll32.exe
PID 664 wrote to memory of 2572	664	lsass.exe	sysmon.exe
PID 664 wrote to memory of 2572	664	lsass.exe	sysmon.exe
PID 664 wrote to memory of 2460	664	lsass.exe	backgroundTaskHost.exe
PID 664 wrote to memory of 2460	664	lsass.exe	backgroundTaskHost.exe
PID 664 wrote to memory of 2460	664	lsass.exe	backgroundTaskHost.exe
PID 664 wrote to memory of 2460	664	lsass.exe	backgroundTaskHost.exe
PID 664 wrote to memory of 2460	664	lsass.exe	backgroundTaskHost.exe
PID 664 wrote to memory of 2460	664	lsass.exe	backgroundTaskHost.exe
PID 664 wrote to memory of 2460	664	lsass.exe	backgroundTaskHost.exe
PID 664 wrote to memory of 2460	664	lsass.exe	backgroundTaskHost.exe
PID 664 wrote to memory of 2460	664	lsass.exe	backgroundTaskHost.exe
PID 664 wrote to memory of 2460	664	lsass.exe	backgroundTaskHost.exe
PID 664 wrote to memory of 2460	664	lsass.exe	backgroundTaskHost.exe
PID 664 wrote to memory of 2572	664	lsass.exe	sysmon.exe
PID 664 wrote to memory of 2572	664	lsass.exe	sysmon.exe
PID 664 wrote to memory of 4504	664	lsass.exe	BackgroundTransferHost.exe
PID 664 wrote to memory of 4504	664	lsass.exe	BackgroundTransferHost.exe
PID 664 wrote to memory of 4504	664	lsass.exe	BackgroundTransferHost.exe
PID 664 wrote to memory of 4504	664	lsass.exe	BackgroundTransferHost.exe
PID 664 wrote to memory of 4504	664	lsass.exe	BackgroundTransferHost.exe
PID 664 wrote to memory of 4504	664	lsass.exe	BackgroundTransferHost.exe
PID 664 wrote to memory of 4504	664	lsass.exe	BackgroundTransferHost.exe
PID 664 wrote to memory of 4504	664	lsass.exe	BackgroundTransferHost.exe
PID 664 wrote to memory of 4504	664	lsass.exe	BackgroundTransferHost.exe
PID 664 wrote to memory of 4504	664	lsass.exe	BackgroundTransferHost.exe
PID 664 wrote to memory of 4504	664	lsass.exe	BackgroundTransferHost.exe
PID 664 wrote to memory of 2572	664	lsass.exe	sysmon.exe
PID 664 wrote to memory of 2572	664	lsass.exe	sysmon.exe
PID 664 wrote to memory of 2572	664	lsass.exe	sysmon.exe
PID 664 wrote to memory of 2572	664	lsass.exe	sysmon.exe
PID 2944 wrote to memory of 3424	2944	werfault.exe	Explorer.EXE
PID 664 wrote to memory of 2572	664	lsass.exe	sysmon.exe
PID 664 wrote to memory of 2572	664	lsass.exe	sysmon.exe
PID 664 wrote to memory of 2572	664	lsass.exe	sysmon.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:664

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2572

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\dcb3ab43a6ea430667bd1b5283ef0db79b2349031c0e91b3b4e1403b24c98d80.exe
  "C:\Users\Admin\AppData\Local\Temp\dcb3ab43a6ea430667bd1b5283ef0db79b2349031c0e91b3b4e1403b24c98d80.exe"
  2⤵
  PID:3436
- - C:\Windows\System32\werfault.exe
    \??\C:\Windows\System32\werfault.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\system32\rundll32.exe
      C:\Windows\system32\rundll32.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3932
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /all
        5⤵
        Gathers network information
        
        PID:1316
  - - C:\Windows\system32\rundll32.exe
      C:\Windows\system32\rundll32.exe
      4⤵
      PID:4752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C set
      4⤵
      PID:1700
  - - C:\Windows\system32\rundll32.exe
      C:\Windows\system32\rundll32.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3808
  - - C:\Windows\system32\rundll32.exe
      C:\Windows\system32\rundll32.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2996
  - - C:\Windows\system32\rundll32.exe
      C:\Windows\system32\rundll32.exe
      4⤵
      PID:1180

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2460

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/664-30-0x000002799F950000-0x000002799F951000-memory.dmp

Filesize
4KB

Download
memory/1180-32-0x000001C34E790000-0x000001C34E7C1000-memory.dmp

Filesize
196KB

Download
memory/2944-1-0x0000014C11110000-0x0000014C1115C000-memory.dmp

Filesize
304KB

Download
memory/2944-2-0x0000014C11400000-0x0000014C11458000-memory.dmp

Filesize
352KB

Download
memory/2944-3-0x0000014C11400000-0x0000014C11458000-memory.dmp

Filesize
352KB

Download
memory/2996-28-0x000001D08CE70000-0x000001D08CE85000-memory.dmp

Filesize
84KB

Download
memory/3424-41-0x00000000030C0000-0x00000000030D9000-memory.dmp

Filesize
100KB

Download
memory/3424-40-0x0000000002A20000-0x0000000002A35000-memory.dmp

Filesize
84KB

Download
memory/3436-0-0x00007FFD65870000-0x00007FFD65A65000-memory.dmp

Filesize
2.0MB

Download
memory/3808-26-0x000001C4C1510000-0x000001C4C155D000-memory.dmp

Filesize
308KB

Download
memory/3932-27-0x00007FFD45615000-0x00007FFD45616000-memory.dmp

Filesize
4KB

Download
memory/3932-11-0x00007FFD45360000-0x00007FFD45D01000-memory.dmp

Filesize
9.6MB

Download
memory/3932-12-0x00007FFD45360000-0x00007FFD45D01000-memory.dmp

Filesize
9.6MB

Download
memory/3932-13-0x00007FFD45360000-0x00007FFD45D01000-memory.dmp

Filesize
9.6MB

Download
memory/3932-4-0x0000019681600000-0x0000019681622000-memory.dmp

Filesize
136KB

Download
memory/3932-5-0x00000196818C0000-0x00000196818E6000-memory.dmp

Filesize
152KB

Download
memory/3932-6-0x00000196818C0000-0x00000196818E6000-memory.dmp

Filesize
152KB

Download
memory/3932-25-0x00007FFD45360000-0x00007FFD45D01000-memory.dmp

Filesize
9.6MB

Download
memory/3932-7-0x00007FFD45615000-0x00007FFD45616000-memory.dmp

Filesize
4KB

Download
memory/3932-29-0x00007FFD45360000-0x00007FFD45D01000-memory.dmp

Filesize
9.6MB

Download
memory/3932-21-0x00000196818C0000-0x00000196818E6000-memory.dmp

Filesize
152KB

Download
memory/3932-8-0x0000019681D10000-0x0000019681D18000-memory.dmp

Filesize
32KB

Download
memory/3932-9-0x00007FFD45360000-0x00007FFD45D01000-memory.dmp

Filesize
9.6MB

Download
memory/3932-10-0x00007FFD45360000-0x00007FFD45D01000-memory.dmp

Filesize
9.6MB

Download
memory/4752-17-0x00007FFD45615000-0x00007FFD45616000-memory.dmp

Filesize
4KB

Download
memory/4752-24-0x0000022A7B310000-0x0000022A7B336000-memory.dmp

Filesize
152KB

Download
memory/4752-23-0x00007FFD45360000-0x00007FFD45D01000-memory.dmp

Filesize
9.6MB

Download
memory/4752-20-0x00007FFD45360000-0x00007FFD45D01000-memory.dmp

Filesize
9.6MB

Download
memory/4752-22-0x00007FFD45360000-0x00007FFD45D01000-memory.dmp

Filesize
9.6MB

Download
memory/4752-19-0x00007FFD45360000-0x00007FFD45D01000-memory.dmp

Filesize
9.6MB

Download
memory/4752-18-0x00007FFD45360000-0x00007FFD45D01000-memory.dmp

Filesize
9.6MB

Download
memory/4752-16-0x0000022A7B310000-0x0000022A7B336000-memory.dmp

Filesize
152KB

Download
memory/4752-38-0x0000022A7B310000-0x0000022A7B336000-memory.dmp

Filesize
152KB

Download
memory/4752-39-0x00007FFD45360000-0x00007FFD45D01000-memory.dmp

Filesize
9.6MB

Download
memory/4752-15-0x0000022A7B310000-0x0000022A7B336000-memory.dmp

Filesize
152KB

Download
memory/4752-14-0x0000022A7B050000-0x0000022A7B072000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads