Overview

overview

10

Static

static

3

mimilib.exe

windows7-x64

10

mimilib.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mimilib.exe

  • Size

    400KB

  • Sample

    250210-s6hkmswmhj

  • MD5

    52d843d99b8783b0eda83ec6a35cc37a

  • SHA1

    40bc79ac3ff1ac7b533c92a9991d528790fb06fd

  • SHA256

    efab2072095d507acf7eebe1d8e2641d741e62688edd926cf1a52c8899bb5b66

  • SHA512

    fb5c4ae50c111ed507cae077867cf94a4a9f571dc3a5fdea99a63a8daa92096028d848c9a36c5fcb8f2cb3a9478eb45866757bfbab2f56e5e255a95710c243eb

  • SSDEEP

    12288:I/XEXxg5SJgzF9X+t4Uq9TUVAO/b2G5jNhZ1L:I/XEXjJSFHUKat/TNpL

Score
10/10
mimikatzdefense_evasiondiscoveryprivilege_escalation

Malware Config

Targets

    • Target

      mimilib.exe

    • Size

      400KB

    • MD5

      52d843d99b8783b0eda83ec6a35cc37a

    • SHA1

      40bc79ac3ff1ac7b533c92a9991d528790fb06fd

    • SHA256

      efab2072095d507acf7eebe1d8e2641d741e62688edd926cf1a52c8899bb5b66

    • SHA512

      fb5c4ae50c111ed507cae077867cf94a4a9f571dc3a5fdea99a63a8daa92096028d848c9a36c5fcb8f2cb3a9478eb45866757bfbab2f56e5e255a95710c243eb

    • SSDEEP

      12288:I/XEXxg5SJgzF9X+t4Uq9TUVAO/b2G5jNhZ1L:I/XEXjJSFHUKat/TNpL

    Score
    10/10
    mimikatzdefense_evasiondiscoveryprivilege_escalation

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Mimikatz family

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks