Overview

overview

10

Static

static

10

update.exe

windows7-x64

10

update.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-01-2025 09:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    update.exe

  • Size

    1.7MB

  • MD5

    96534a71f4866c5e10d16b0c076516a8

  • SHA1

    fe38e4e9823284f050eefdbebe0ee1079652e3ef

  • SHA256

    9d06018f57d680e259aad12814c93f666142e34571e24ddca23984bfd3e6846d

  • SHA512

    ce4af86b11e60c256168cb04dc6d402cfbebff68211d3998aed974846a115a594cff938b3ca3d03591872d54a4723cad10489eec841526ed3d08d842d54a7992

  • SSDEEP

    49152:Ptk3Py52UmGrNqbe+nHj0pHiEPKEk7mUW:Ptk3q2fO0rQH4d

Score
10/10
mimikatz

Malware Config

Signatures

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • Mimikatz family
    mimikatz
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\update.exe
    "C:\Users\Admin\AppData\Local\Temp\update.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Windows\system32\cmd.exe
      cmd
      2⤵
        PID:2608

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2936-0-0x000007FEF6343000-0x000007FEF6344000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2936-1-0x0000000000130000-0x00000000002F2000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/2936-2-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2936-4-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2936-5-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

      Filesize

      9.9MB

      Download