Behavioral task
behavioral1
Sample
2025-01-17_903b68863831b8be2f1ecaa0c6ba2974_hacktools_icedid_mimikatz.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2025-01-17_903b68863831b8be2f1ecaa0c6ba2974_hacktools_icedid_mimikatz.exe
Resource
win10v2004-20241007-en
General
-
Target
2025-01-17_903b68863831b8be2f1ecaa0c6ba2974_hacktools_icedid_mimikatz
-
Size
7.2MB
-
MD5
903b68863831b8be2f1ecaa0c6ba2974
-
SHA1
2e8c437d5ef8b32c6bd4623a7bca299f9309d95d
-
SHA256
2fb9f57b73422459258e775a93f296e000cc825bdad4f2d45680344eb98f6e01
-
SHA512
cbba5465a4dca26712575e81bf12939de51b42f4dce0903fef2391f4736f6188fb669cacbda27815b39103fa238b0ae8fcfb5437995f6c9f2bcba0b9d984cfac
-
SSDEEP
196608:5po1mknGzwHdOgEPHd9BbX/nivPlTXTYe:Ygjz0E57/iv1
Malware Config
Signatures
-
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule sample mimikatz -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-01-17_903b68863831b8be2f1ecaa0c6ba2974_hacktools_icedid_mimikatz -
NSIS installer 1 IoCs
resource yara_rule sample nsis_installer_2
Files
-
2025-01-17_903b68863831b8be2f1ecaa0c6ba2974_hacktools_icedid_mimikatz.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 740KB - Virtual size: 738KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ