mimikatz | 1e808458dd8f9a8f60d754df72315ceddeba64dd36ce915d32dcacf74be465c7

Sharing

Copy URL

Twitter E-mail

General

Target

1e808458dd8f9a8f60d754df72315ceddeba64dd36ce915d32dcacf74be465c7
Size

3.1MB
MD5

48ed36a06a49b006eb489cdbfbd07df6
SHA1

5bddca7ef2d14248cf2fd0056876d92e597e8de3
SHA256

1e808458dd8f9a8f60d754df72315ceddeba64dd36ce915d32dcacf74be465c7
SHA512

f1b54eb7252798cac0d939f6b627074c26684e010a8311bb87f69160c9420ce0f1605f854c5a9157c6b94949943d1baf8043917771ef4744325730db130be0e8
SSDEEP

98304:WZFdGrHksMD8MxU02fwJhpTu9I4AxdpyYQ:WrCMgMxU02oJhE902YQ

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
static1/unpack001/1f2df15442593b159e45d16a27e4d43d3a9062da212a588ba4c048f214a0b7be	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1f2df15442593b159e45d16a27e4d43d3a9062da212a588ba4c048f214a0b7be

Files

1e808458dd8f9a8f60d754df72315ceddeba64dd36ce915d32dcacf74be465c7
.zip

Password: infected
1f2df15442593b159e45d16a27e4d43d3a9062da212a588ba4c048f214a0b7be
.exe windows:6 windows x86 arch:x86

1b592c1c6260c7ecc488f8559ad29e2a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\paid_memes\wmi_smb_rdp_checker\Release\checker.pdb

Imports

urlmon

URLOpenBlockingStreamA

winmm

waveInClose
waveInPrepareHeader
waveInOpen
waveInAddBuffer
waveInStart
waveInReset
waveInGetDevCapsW
waveInGetNumDevs
waveOutReset
waveInUnprepareHeader
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
waveOutGetErrorTextW
waveOutGetDevCapsW
waveOutGetNumDevs
timeEndPeriod
timeBeginPeriod
waveOutWrite

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

ws2_32

WSACloseEvent
send
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
WSAGetLastError
ntohs
WSASetLastError
inet_ntop
setsockopt
closesocket
WSACreateEvent
inet_addr
socket
connect
getsockopt
htons
ioctlsocket
WSACleanup
WSAStartup
WSAIoctl
inet_pton
__WSAFDIsSet
accept
select
bind
getsockname
htonl
listen
recv
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername
WSAEnumNetworkEvents
gethostname

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
OutputDebugStringW
GetFileSizeEx
SetFilePointer
SetFilePointerEx
SetErrorMode
GetTickCount
GetModuleFileNameW
MulDiv
SetThreadExecutionState
ExitProcess
TerminateProcess
GlobalMemoryStatusEx
GetSystemInfo
CreateDirectoryW
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
ReleaseSemaphore
WaitForSingleObjectEx
CreateSemaphoreW
GetEnvironmentVariableA
SetEnvironmentVariableA
IsDebuggerPresent
RaiseException
CreateThread
GetCurrentThread
SetThreadPriority
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
VerSetConditionMask
CreateFileA
DeviceIoControl
GetOverlappedResult
CancelIo
ResetEvent
CreateEventW
LocalFree
FormatMessageW
VerifyVersionInfoW
TlsAlloc
TlsGetValue
TlsSetValue
LoadLibraryExW
CompareStringA
GetModuleHandleExW
GetSystemPowerStatus
GetLocaleInfoA
HeapSize
TlsFree
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
AssignProcessToJobObject
GetSystemTimeAsFileTime
GetModuleHandleW
GetCPInfo
LCMapStringEx
DecodePointer
EncodePointer
CompareStringEx
GetExitCodeThread
TryAcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
GetStringTypeW
SleepConditionVariableSRW
WakeAllConditionVariable
GetLocaleInfoEx
FormatMessageA
GetFileInformationByHandleEx
AreFileApisANSI
SetFileInformationByHandle
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
GetCurrentDirectoryW
lstrlenW
FindNextFileW
FindFirstFileW
FindClose
CreateMutexW
ReleaseMutex
GetModuleHandleA
SleepEx
GetCurrentProcessId
WaitForMultipleObjects
GetFileType
MoveFileExW
InitializeCriticalSectionEx
SetLastError
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Wow64DisableWow64FsRedirection
WriteFile
GetStdHandle
GetCurrentProcess
SetConsoleTextAttribute
SizeofResource
ReadFile
GetConsoleWindow
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetWindowsDirectoryW
CloseHandle
GetLastError
IsWow64Process
CreateProcessW
FindResourceW
LoadResource
LockResource
Wow64RevertWow64FsRedirection
CreateFileW
WaitForSingleObject
PeekNamedPipe
CreatePipe
GetSystemDirectoryW
CreateJobObjectW
SetInformationJobObject
WriteConsoleW
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
DeleteFileW
FileTimeToSystemTime
GetCommandLineA
GetCommandLineW
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
HeapReAlloc
GetExitCodeProcess
SetStdHandle
SetEndOfFile
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap

user32

GetClipboardData
EmptyClipboard
CloseClipboard
SetClipboardData
MessageBoxW
MessageBoxA
MonitorFromWindow
MonitorFromRect
CreateIconFromResource
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowThreadProcessId
GetParent
SetWindowLongW
PtInRect
IntersectRect
GetWindowTextLengthW
OpenClipboard
GetAsyncKeyState
SetWindowRgn
GetDesktopWindow
GetRawInputDeviceInfoA
GetRawInputDeviceList
PostThreadMessageW
DialogBoxIndirectParamW
EndDialog
GetDlgItem
DrawTextW
SystemParametersInfoA
GetWindowTextW
SetWindowTextW
RemovePropW
SetPropW
SetForegroundWindow
SetActiveWindow
GetFocus
SetFocus
FlashWindowEx
SetLayeredWindowAttributes
CreateWindowExW
RegisterClassW
AttachThreadInput
SendMessageW
RegisterRawInputDevices
SystemParametersInfoW
CreateIconIndirect
ShowWindow
IsWindowVisible
TrackMouseEvent
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetMessageExtraInfo
PostMessageW
DefWindowProcW
CallWindowProcW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
SetWindowPos
IsIconic
GetKeyState
SetTimer
KillTimer
GetSystemMetrics
GetMenu
GetForegroundWindow
GetDC
GetUpdateRect
InvalidateRect
ValidateRect
GetPropW
GetClientRect
CopyImage
LoadCursorW
SetCursorPos
ReleaseCapture
SetCapture
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
EnumDisplayDevicesW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
ReleaseDC
MapVirtualKeyW
ToUnicode
GetKeyboardState
GetKeyboardLayout
IsClipboardFormatAvailable
GetClipboardSequenceNumber
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetDoubleClickTime
RegisterWindowMessageA
GetRawInputData
DestroyIcon
LoadIconW
CallNextHookEx
GetWindowLongW
IsRectEmpty
FillRect
ClipCursor
ScreenToClient
ClientToScreen
GetClipCursor
GetCursorPos
SetCursor
AdjustWindowRectEx
GetWindowRect

gdi32

DeleteDC
CreateCompatibleDC
DeleteObject
CreateSolidBrush
SelectObject
CreateDIBSection
CreateCompatibleBitmap
CreateDCW
GetDeviceCaps
GetDIBits
CreateBitmap
GetICMProfileW
GetDeviceGammaRamp
SetDeviceGammaRamp
CombineRgn
CreateRectRgn
ChoosePixelFormat
DescribePixelFormat
GetPixelFormat
SetPixelFormat
SwapBuffers
BitBlt
CreateFontIndirectW
GetTextExtentPoint32A
GetTextMetricsW

advapi32

CryptGenRandom
CryptGetHashParam
CryptAcquireContextA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptReleaseContext

shell32

SHGetFolderPathW
DragAcceptFiles
ShellExecuteW
DragFinish
ExtractIconExW
DragQueryFileW

ole32

PropVariantClear
CoCreateInstance
CoTaskMemFree
CLSIDFromString
CoInitializeEx
CoUninitialize

oleaut32

SysFreeString

imm32

ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmGetIMEFileNameA
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmNotifyIME
ImmSetCompositionWindow

bcrypt

BCryptGenRandom

setupapi

CM_Get_Device_IDA
SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsA
CM_Locate_DevNodeA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_Parent
SetupDiGetDeviceInterfaceDetailA

crypt32

CertFreeCertificateContext
CryptDecodeObjectEx
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CryptStringToBinaryW
PFXImportCertStore
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertFindCertificateInStore

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 634KB - Virtual size: 633KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 98KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

1b592c1c6260c7ecc488f8559ad29e2a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

urlmon

winmm

version

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

imm32

bcrypt

setupapi

crypt32

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 634KB - Virtual size: 633KB

.data Size: 98KB - Virtual size: 136KB

.rsrc Size: 3.7MB - Virtual size: 3.7MB

.reloc Size: 106KB - Virtual size: 106KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 634KB - Virtual size: 633KB

.data
Size: 98KB - Virtual size: 136KB

.rsrc
Size: 3.7MB - Virtual size: 3.7MB

.reloc
Size: 106KB - Virtual size: 106KB