Overview

overview

10

Static

static

10

mimikatzWi...rv.sys

windows7-x64

10

mimikatzWi...rv.sys

windows10-2004-x64

10

mimikatzWi...tz.exe

windows7-x64

3

mimikatzWi...tz.exe

windows10-2004-x64

3

mimikatzWi...ib.dll

windows7-x64

3

mimikatzWi...ib.dll

windows10-2004-x64

3

mimikatzWi...ve.exe

windows7-x64

3

mimikatzWi...ve.exe

windows10-2004-x64

3

mimikatzWi.../rules

ubuntu-18.04-amd64

1

mimikatzWi.../rules

debian-9-armhf

1

mimikatzWi.../rules

debian-9-mips

1

mimikatzWi.../rules

debian-9-mipsel

1

mimikatzWi...rv.sys

windows7-x64

10

mimikatzWi...rv.sys

windows10-2004-x64

10

mimikatzWi...tz.exe

windows7-x64

1

mimikatzWi...tz.exe

windows10-2004-x64

1

mimikatzWi...ib.dll

windows7-x64

1

mimikatzWi...ib.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    92s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-12-2024 16:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    mimikatzWindows-master/x64/mimidrv.sys

  • Size

    35KB

  • MD5

    c8541a9cef64589593e999968a0385b9

  • SHA1

    fe18c58fbd0a83d67920e037d522c176704d2ca3

  • SHA256

    f9b01406864ab081aa77eef4ad15cb2dd2f830d1ef54f52622a59ff1aeb05ba5

  • SHA512

    faf69095bf6ce18724163fcaaed851dc39949dcd21d4432c4d1734ccfbbe86c3e2bc17fd8c7c9b31b7e62f73e8a183852a358fe07f18570ce3281e2fe7b92bee

  • SSDEEP

    768:Si4mpA/ZBEAKaCTC/dBm8ipSfJvl1qlCGB8YluQYVHZC5islW:umaEAKEYaJlQlHB8YlhYJwisg

Score
10/10
mimikatz

Malware Config

Signatures

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • Mimikatz family
    mimikatz
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\mimikatzWindows-master\x64\mimidrv.sys
    1⤵
      PID:880
      • C:\Users\Admin\AppData\Local\Temp\mimikatzWindows-master\x64\mimidrv.sys
        C:\Users\Admin\AppData\Local\Temp\mimikatzWindows-master\x64\mimidrv.sys
        2⤵
          PID:4556

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4556-0-0x0000000000010000-0x000000000001E000-memory.dmp

        Filesize

        56KB

        Download