Overview
overview
10Static
static
10Win32/mimidrv.sys
windows7-x64
10Win32/mimidrv.sys
windows10-2004-x64
10Win32/mimikatz.exe
windows7-x64
3Win32/mimikatz.exe
windows10-2004-x64
3Win32/mimilib.dll
windows7-x64
3Win32/mimilib.dll
windows10-2004-x64
3Win32/mimilove.exe
windows7-x64
3Win32/mimilove.exe
windows10-2004-x64
3Win32/mimispool.dll
windows7-x64
3Win32/mimispool.dll
windows10-2004-x64
3x64/mimidrv.sys
windows7-x64
10x64/mimidrv.sys
windows10-2004-x64
10x64/mimikatz.exe
windows7-x64
1x64/mimikatz.exe
windows10-2004-x64
1x64/mimilib.dll
windows7-x64
1x64/mimilib.dll
windows10-2004-x64
1x64/mimispool.dll
windows7-x64
1x64/mimispool.dll
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 04:04
Behavioral task
behavioral1
Sample
Win32/mimidrv.sys
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Win32/mimidrv.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Win32/mimikatz.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Win32/mimikatz.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Win32/mimilib.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Win32/mimilib.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Win32/mimilove.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Win32/mimilove.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Win32/mimispool.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Win32/mimispool.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
x64/mimidrv.sys
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
x64/mimidrv.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
x64/mimikatz.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
x64/mimikatz.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
x64/mimilib.dll
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
x64/mimilib.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
x64/mimispool.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
x64/mimispool.dll
Resource
win10v2004-20241007-en
General
-
Target
Win32/mimispool.dll
-
Size
10KB
-
MD5
dab7a18b02399053ba3ff1e568789fce
-
SHA1
ceee090c9ee8279d6410d8d450d55acb81d34766
-
SHA256
05842de51ede327c0f55df963f6de4e32ab88f43a73b9e0e1d827bc70199eff0
-
SHA512
6dd0ade4112d7ed44c090f81614ed2f1d84cfcb25a45b08d22b3fa74e4e3f9b99f719f8bca9c1f03d13757f38eac072bb4d55e229c478524bf348f76fc3e36dd
-
SSDEEP
192:I191rqbIcL9uD3nhKlWUEHRl1RtnIDKwIb/DtC0uolZC7:RRgDXhKAUQlftO6tC0uols
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3760 wrote to memory of 1376 3760 rundll32.exe 83 PID 3760 wrote to memory of 1376 3760 rundll32.exe 83 PID 3760 wrote to memory of 1376 3760 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Win32\mimispool.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Win32\mimispool.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1376
-