Analysis
-
max time kernel
93s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
30/01/2025, 13:32 UTC
General
-
Target
home/maciek/mimikatz/Win32/mimikatz.exe
-
Size
1.0MB
-
MD5
6c9ad4e67032301a61a9897377d9cff8
-
SHA1
655979d56e874fbe7561bb1b6e512316c25cbb19
-
SHA256
e81a8f8ad804c4d83869d7806a303ff04f31cce376c5df8aada2e9db2c1eeb98
-
SHA512
1cd75a4c324365735a97001b55e89b936daed5d003ba7059f885eeca4a26eaaa82041450d77483a36d4be30186730c4e4ca4b8af24122fe403c4dde738d3ff96
-
SSDEEP
24576:EuS0VSrYkTp5VFyI0UZK6zU9T8zPnbJFDhOky0c:EuS0O59cX2YcPb7DhCN
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\home\maciek\mimikatz\Win32\mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\home\maciek\mimikatz\Win32\mimikatz.exe"1⤵
- System Location Discovery: System Language Discovery
Network
-
DNS22.160.190.20.in-addr.arpaRemote address:8.8.8.8:53Request22.160.190.20.in-addr.arpaIN PTRResponse -
DNS57.169.31.20.in-addr.arpaRemote address:8.8.8.8:53Request57.169.31.20.in-addr.arpaIN PTRResponse
-
DNS212.20.149.52.in-addr.arpaRemote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
DNS206.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
DNS13.153.16.2.in-addr.arpaRemote address:8.8.8.8:53Request13.153.16.2.in-addr.arpaIN PTRResponse13.153.16.2.in-addr.arpaIN PTRa2-16-153-13deploystaticakamaitechnologiescom
-
DNS23.236.111.52.in-addr.arpaRemote address:8.8.8.8:53Request23.236.111.52.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:5322.160.190.20.in-addr.arpadns
DNS Request
22.160.190.20.in-addr.arpa
-
8.8.8.8:5357.169.31.20.in-addr.arpadns
DNS Request
57.169.31.20.in-addr.arpa
-
8.8.8.8:53212.20.149.52.in-addr.arpadns
DNS Request
212.20.149.52.in-addr.arpa
-
8.8.8.8:53206.23.85.13.in-addr.arpadns
DNS Request
206.23.85.13.in-addr.arpa
-
8.8.8.8:5313.153.16.2.in-addr.arpadns
DNS Request
13.153.16.2.in-addr.arpa
-
8.8.8.8:5323.236.111.52.in-addr.arpadns
DNS Request
23.236.111.52.in-addr.arpa