mimikatz | b6ae167bc7a98a16120698f2f11452449118662dd3f1cc88e6ef7286465b45ca | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-02-2025 11:29

Sharing

Report Analysis Logs

General

Target

Videos/64/mimidrv.sys
Size

36KB
MD5

c94de9019767a79573b25c870936d9a8
SHA1

c66a1c6fbeacaf2db288bff8c064dfe775fd1508
SHA256

bee3d0ac0967389571ea8e3a8c0502306b3dbf009e8155f00a2829417ac079fc
SHA512

e8b712a0b0b65520ec17e5576fe1c7c61a2a2a13502f9626625ef4b988b84178f68c0ca2337e2d766e42c19a681a7df41de3faef950ab0698139b89463ec2031
SSDEEP

768:APVvAF3Sz0Kp4TC/ndBW8ipSfnA+vl1qlCGB8zlu0xVHZC5isB:0VvPz0K3AmDlQlHB8zl9xJwisB

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral9/memory/2524-0-0x0000000000010000-0x000000000001E000-memory.dmp	mimikatz

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Videos\64\mimidrv.sys
1⤵
PID:1548
- C:\Users\Admin\AppData\Local\Temp\Videos\64\mimidrv.sys
  C:\Users\Admin\AppData\Local\Temp\Videos\64\mimidrv.sys
  2⤵
  PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-0-0x0000000000010000-0x000000000001E000-memory.dmp

Filesize
56KB

Download