mimikatz | mimikatz[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mimikatz.exe
Size 1.3MB
Sample260603-pgalysfy7n
SHA256 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5
SHA1 e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
SHA512 f00b1ab035aa574c70f6b95b63f676fa75ff8f379f92e85ad5872c358a6bb1ed5417fdd226d421307a48653577ca42aba28103b3b2d7a5c572192d6e5f07e8b3
SSDEEP 24576:0CgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODvsG:0CI7XBE2IuF64rIlmdii
TLSH
T129552901A7E90098F2B79AB59EF29516DBB378D51834C30F02A88A5F1F73F519D29732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mimikatz

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mimikatz.exe

File Explorer

mimikatz.exe

.exe 1.3MB

mimikatz.exe

IMPHASH 55ee500bb4bdfc49f27a98ae456d8edf
SHA256 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5
SHA1 e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
SHA512 f00b1ab035aa574c70f6b95b63f676fa75ff8f379f92e85ad5872c358a6bb1ed5417fdd226d421307a48653577ca42aba28103b3b2d7a5c572192d6e5f07e8b3
SSDEEP 24576:0CgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODvsG:0CI7XBE2IuF64rIlmdii
TLSH
T129552901A7E90098F2B79AB59EF29516DBB378D51834C30F02A88A5F1F73F519D29732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

825576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptSetHashParam CryptGetHashParam CryptExportKey CryptAcquireContextW CryptSetKeyParam CryptGetKeyParam CryptReleaseContext CryptDuplicateKey CryptAcquireContextA CryptGetProvParam CryptImportKey SystemFunction007 CryptEncrypt CryptCreateHash CryptGenKey CryptDestroyKey CryptDecrypt CryptDestroyHash CryptHashData CopySid GetLengthSid LsaQueryInformationPolicy LsaOpenPolicy LsaClose CreateWellKnownSid CreateProcessWithLogonW CreateProcessAsUserW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegSetValueExW SystemFunction033 SystemFunction032 ConvertSidToStringSidW CreateServiceW CloseServiceHandle DeleteService OpenSCManagerW SetServiceObjectSecurity OpenServiceW BuildSecurityDescriptorW QueryServiceObjectSecurity StartServiceW AllocateAndInitializeSid QueryServiceStatusEx FreeSid ControlService IsTextUnicode OpenProcessToken GetTokenInformation LookupAccountNameW LookupAccountSidW DuplicateTokenEx CheckTokenMembership CryptSetProvParam CryptEnumProvidersW ConvertStringSidToSidW LsaFreeMemory GetSidSubAuthority GetSidSubAuthorityCount IsValidSid SetThreadToken CryptEnumProviderTypesW SystemFunction006 CryptGetUserKey OpenEventLogW GetNumberOfEventLogRecords ClearEventLogW SystemFunction001 CryptDeriveKey SystemFunction005 LsaQueryTrustedDomainInfoByName CryptSignHashW LsaSetSecret SystemFunction023 LsaOpenSecret LsaQuerySecret LsaRetrievePrivateData LsaEnumerateTrustedDomainsEx LookupPrivilegeValueW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW LookupPrivilegeNameW OpenThreadToken EqualSid CredFree CredEnumerateW SystemFunction026 ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction027 SystemFunction041 CredIsMarshaledCredentialW CredUnmarshalCredentialW A_SHAFinal A_SHAInit A_SHAUpdate

cabinet

ord11 ord14 ord10 ord13

crypt32

CryptSignAndEncodeCertificate CertEnumSystemStore CertEnumCertificatesInStore CertAddCertificateContextToStore CryptDecodeObjectEx CryptStringToBinaryA CertAddEncodedCertificateToStore CertOpenStore CertFreeCertificateContext CertCloseStore CryptStringToBinaryW CertSetCertificateContextProperty PFXExportCertStoreEx CryptUnprotectData CryptBinaryToStringW CryptBinaryToStringA CryptExportPublicKeyInfo CryptFindOIDInfo CryptAcquireCertificatePrivateKey CertNameToStrW CertFindCertificateInStore CertGetCertificateContextProperty CertGetNameStringW CryptEncodeObject CryptProtectData CryptQueryObject

cryptdll

MD5Init MD5Final CDLocateCSystem CDGenerateRandomBits CDLocateCheckSum MD5Update

dnsapi

DnsFree DnsQuery_A

fltlib

FilterFindFirst FilterFindNext

mpr

WNetCancelConnection2W WNetAddConnection2W

netapi32

NetStatisticsGet DsGetDcNameW NetApiBufferFree NetRemoteTOD NetSessionEnum NetServerGetInfo DsEnumerateDomainTrustsW NetShareEnum NetWkstaUserEnum I_NetServerAuthenticate2 I_NetServerTrustPasswordsGet I_NetServerReqChallenge

odbc32

ord75 ord9 ord43 ord24 ord31 ord111 ord141 ord13

ole32

CoInitializeEx CoSetProxyBlanket CoTaskMemFree CoUninitialize CoCreateInstance

oleaut32

SysAllocString VariantInit SysFreeString VariantClear

rpcrt4

RpcBindingFree RpcBindingFromStringBindingW RpcStringBindingComposeW MesEncodeIncrementalHandleCreate RpcBindingSetAuthInfoExW RpcBindingInqAuthClientW RpcBindingSetOption RpcImpersonateClient RpcStringFreeW RpcRevertToSelf MesDecodeIncrementalHandleCreate MesHandleFree MesIncrementalHandleReset NdrMesTypeDecode2 NdrMesTypeAlignSize2 NdrMesTypeFree2 NdrMesTypeEncode2 RpcServerUnregisterIfEx I_RpcBindingInqSecurityContext RpcServerInqBindings RpcServerListen RpcMgmtWaitServerListen RpcEpRegisterW RpcMgmtStopServerListening RpcBindingToStringBindingW RpcServerRegisterIf2 RpcServerRegisterAuthInfoW RpcBindingVectorFree UuidToStringW RpcServerUseProtseqEpW RpcEpUnregister NdrServerCall2 NdrClientCall2 UuidCreate RpcEpResolveBinding RpcBindingSetObject RpcBindingSetAuthInfoW RpcMgmtEpEltInqDone RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin I_RpcGetCurrentCallHandle

shlwapi

UrlUnescapeW PathIsDirectoryW PathFindFileNameW PathIsRelativeW PathCombineW PathCanonicalizeW

samlib

SamEnumerateAliasesInDomain SamQueryInformationUser SamCloseHandle SamEnumerateDomainsInSamServer SamFreeMemory SamEnumerateUsersInDomain SamOpenUser SamLookupDomainInSamServer SamLookupNamesInDomain SamLookupIdsInDomain SamOpenDomain SamConnect SamSetInformationUser SamiChangePasswordUser SamEnumerateGroupsInDomain SamGetGroupsForUser SamGetMembersInGroup SamGetMembersInAlias SamRidToSid SamGetAliasMembership SamOpenGroup SamOpenAlias

secur32

FreeContextBuffer LsaLookupAuthenticationPackage LsaFreeReturnBuffer LsaDeregisterLogonProcess QueryContextAttributesW InitializeSecurityContextW AcquireCredentialsHandleW EnumerateSecurityPackagesW FreeCredentialsHandle DeleteSecurityContext LsaCallAuthenticationPackage LsaConnectUntrusted

shell32

CommandLineToArgvW

user32

SetClipboardViewer DefWindowProcW GetClipboardSequenceNumber OpenClipboard CreateWindowExW GetClipboardData RegisterClassExW TranslateMessage EnumClipboardFormats PostMessageW DispatchMessageW GetKeyboardLayout IsCharAlphaNumericW SendMessageW UnregisterClassW DestroyWindow CloseClipboard GetMessageW ChangeClipboardChain

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

hid

HidD_GetFeature HidD_GetPreparsedData HidD_GetHidGuid HidD_GetAttributes HidD_SetFeature HidP_GetCaps HidD_FreePreparsedData

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

winscard

SCardReleaseContext SCardListCardsW SCardGetCardTypeProviderNameW SCardListReadersW SCardFreeMemory SCardEstablishContext SCardControl SCardConnectW SCardTransmit SCardDisconnect SCardGetAttrib

winsta

WinStationCloseServer WinStationOpenServerW WinStationFreeMemory WinStationConnectW WinStationQueryInformationW WinStationEnumerateW

wldap32

ord36 ord79 ord145 ord73 ord310 ord208 ord13 ord77 ord142 ord54 ord41 ord309 ord304 ord301 ord127 ord26 ord167 ord147 ord133 ord157 ord88 ord14 ord122 ord140 ord203 ord69 ord139 ord97 ord223 ord12 ord113 ord224 ord96 ord27

msasn1

ASN1_CreateModule ASN1_CloseEncoder ASN1_CreateDecoder ASN1_FreeEncoded ASN1_CloseModule ASN1_CreateEncoder ASN1_CloseDecoder ASN1BERDotVal2Eoid

ntdll

strtol _strcmpi strstr towupper _wcstoui64 wcsncmp wcstol strchr strcspn strncmp memmove _wcsnicmp strtoul wcsstr wcschr wcsrchr _stricmp _vscwprintf _wcsicmp strrchr _vsnprintf log memcmp RtlUnicodeStringToAnsiString RtlFreeAnsiString RtlDowncaseUnicodeString RtlFreeUnicodeString RtlInitUnicodeString RtlEqualUnicodeString NtQueryObject RtlCompressBuffer RtlGetCompressionWorkSpaceSize NtQuerySystemInformation RtlGetCurrentPeb NtQueryInformationProcess RtlCreateUserThread RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlEqualString RtlUpcaseUnicodeString RtlAppendUnicodeStringToString RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtQueryDirectoryObject NtResumeProcess NtOpenDirectoryObject RtlAdjustPrivilege NtSuspendProcess NtTerminateProcess NtQuerySystemEnvironmentValueEx NtSetSystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW RtlIpv6AddressToStringW wcstoul __chkstk

kernel32

lstrlenA GetDateFormatW SystemTimeToFileTime ClearCommError CreateRemoteThread WaitForSingleObject CreateProcessW SetConsoleOutputCP GetConsoleOutputCP CreateFileMappingW UnmapViewOfFile MapViewOfFile WriteProcessMemory VirtualAllocEx VirtualProtectEx RtlVirtualUnwind SetFilePointerEx GetProcessId GetComputerNameW IsWow64Process VirtualAlloc SetLastError ReadProcessMemory VirtualFreeEx VirtualQueryEx VirtualFree VirtualQuery GetComputerNameExW DeviceIoControl DuplicateHandle OpenProcess GetCurrentProcess ExpandEnvironmentStringsW FindNextFileW FindClose GetCurrentDirectoryW GetFileSizeEx FlushFileBuffers GetFileAttributesW FindFirstFileW lstrlenW GetProcAddress LoadLibraryW GetModuleHandleW FreeLibrary DeleteFileA GetTempPathA GetFileInformationByHandle FileTimeToLocalFileTime GetCurrentDirectoryA GetTempFileNameA SetFilePointer CreateFileA FileTimeToDosDateTime CreateThread LocalFree CloseHandle LocalAlloc GetLastError CreateFileW ReadFile TerminateThread WriteFile FileTimeToSystemTime Sleep VirtualProtect WideCharToMultiByte GetTimeFormatW GetFullPathNameW GetFullPathNameA HeapReAlloc GetFileSize CreateMutexW HeapCompact SetEndOfFile HeapAlloc QueryPerformanceCounter HeapFree UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap FormatMessageA FormatMessageW GetVersionExW HeapDestroy GetSystemTimeAsFileTime GetFileAttributesA HeapCreate HeapValidate MultiByteToWideChar GetTempPathW HeapSize LockFileEx GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW OutputDebugStringA GetVersionExA DeleteFileW GetCurrentProcessId GetSystemTime AreFileApisANSI ExitProcess ExitThread RaiseException SetConsoleCtrlHandler SetConsoleTitleW SetFileAttributesW GlobalSize SetHandleInformation CreatePipe InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetEvent CreateEventW GetSystemDirectoryW SetConsoleCursorPosition GetTimeZoneInformation GetStdHandle FillConsoleOutputCharacterW GetConsoleScreenBufferInfo SetCurrentDirectoryW GetCurrentThread ProcessIdToSessionId RtlLookupFunctionEntry RtlCaptureContext TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentThreadId PurgeComm

msvcrt

calloc isdigit _fmode _commode __setusermatherr isspace mbtowc __mb_cur_max isleadbyte isxdigit localeconv _snprintf __set_app_type _itoa wctomb ferror iswctype wcstombs ?terminate@@YAXXZ __badioinfo __pioinfo _read _lseeki64 _write _isatty ungetc _amsg_exit _initterm fclose _setmode vwprintf exit _cexit _exit _XcptFilter __wgetmainargs __C_specific_handler memset memcpy _iob getchar _wpgmptr fgetws realloc _msize malloc _vscprintf _errno free _wcsdup vfwprintf fflush _wfopen wprintf _fileno

generic

count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=62, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,

count=3, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=2, id=132, productName=VS2008 build 21022, version=21022,

count=51, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=670, id=1, productName=Unmarked objects,

count=1, id=126, version=50727,

count=114, id=137, version=30729,

count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,