Behavioral task
behavioral1
Sample
mimikatz-vmp.exe
Resource
win7-20240903-en
General
-
Target
mimikatz-vmp.exe
-
Size
5.8MB
-
MD5
5d570daf6dc6db5253b789192d6f0c5e
-
SHA1
bdc8506df8aca91ae9f646edc6e9f8aeb82b02f8
-
SHA256
87a4adcc8c5c10bdf57e4b5ec13b2d2567437034e908982ed276aa4a62a01eb0
-
SHA512
8e77eb19ce9c7267625b54e024a4b71af6bab712180cf7d6ebf7de4adf8e2bae098bc74609ae67d135a426950109e01913fba336ec90aca971eb4a6171b3aeae
-
SSDEEP
98304:5s4aXzeiPlTQ3PmTqlzdsZl5TGiPFsV7bvDdpEPnBg+kJM5:5lOImGFd0THPSDDdsSj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mimikatz-vmp.exe
Files
-
mimikatz-vmp.exe.exe windows:5 windows x64 arch:x64
f9e4e52991070df47f71115af20a8652
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
CryptSetHashParam
A_SHAFinal
cabinet
ord11
crypt32
CertFindCertificateInStore
cryptdll
CDLocateCSystem
dnsapi
DnsFree
fltlib
FilterFindFirst
netapi32
NetServerGetInfo
I_NetServerTrustPasswordsGet
ole32
CoInitializeEx
oleaut32
VariantInit
rpcrt4
RpcMgmtEpEltInqNextW
shlwapi
PathIsDirectoryW
samlib
SamEnumerateGroupsInDomain
secur32
QueryContextAttributesW
shell32
CommandLineToArgvW
user32
IsCharAlphaNumericW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
userenv
CreateEnvironmentBlock
version
VerQueryValueW
hid
HidD_GetAttributes
setupapi
SetupDiGetDeviceInterfaceDetailW
winscard
SCardFreeMemory
winsta
WinStationCloseServer
wldap32
ord122
msasn1
ASN1_CreateModule
ntdll
wcsncmp
kernel32
GetVersionExW
GetVersionExA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
isdigit
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 597KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ