Analysis
-
max time kernel
94s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-11-2024 21:07
General
-
Target
mimikatz-vmp.exe
-
Size
5.8MB
-
MD5
5d570daf6dc6db5253b789192d6f0c5e
-
SHA1
bdc8506df8aca91ae9f646edc6e9f8aeb82b02f8
-
SHA256
87a4adcc8c5c10bdf57e4b5ec13b2d2567437034e908982ed276aa4a62a01eb0
-
SHA512
8e77eb19ce9c7267625b54e024a4b71af6bab712180cf7d6ebf7de4adf8e2bae098bc74609ae67d135a426950109e01913fba336ec90aca971eb4a6171b3aeae
-
SSDEEP
98304:5s4aXzeiPlTQ3PmTqlzdsZl5TGiPFsV7bvDdpEPnBg+kJM5:5lOImGFd0THPSDDdsSj
Score
10/10
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 2 IoCs
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mimikatz-vmp.exe"C:\Users\Admin\AppData\Local\Temp\mimikatz-vmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.3MB
-
Filesize
8KB
-
Filesize
3.6MB
-
Filesize
10.3MB