mimikatz | 2026-07-18_cc24ad94decbeb66524661ad205cedaa_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_cc24ad94decbeb66524661ad205cedaa_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc
Size 668KB
Sample260718-3p4fwsft7j
SHA256 caf12dc6939adf8fd71cdb2341a6509841ac338b734812d4fb6c2b9ff6db9e9c
MD5 cc24ad94decbeb66524661ad205cedaa
SHA1 e159325a4b4aaef91e26df95492f5ba6a94cd371
SHA512 6ca2d8c2ab2a669053330543fdeacfec42e48dfde9a4ac655f5187101dac8e6be66d272773385a32fd21fd9867f30eb12bd96e39af0191dd722540fc5703d904
SSDEEP 6144:LAmH5v2jeGOiFNa9fBx5uaNOcPQYislCjnuFHgaNdEJBoimYuZuTgsFOOwzzU:LA+YeiFNEjFcuFPdEfomwu8s
TLSH
T19FE46D1AB7A411FDD0B7C17ACD424926F7B27C475772A78B03E04AA61F2B6605E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mimikatz

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_cc24ad94decbeb66524661ad205cedaa_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-18_cc24ad94decbeb66524661ad205cedaa_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

.exe 668KB

2026-07-18_cc24ad94decbeb66524661ad205cedaa_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

IMPHASH 1822e74c5686d54671e7ea49f6626653
SHA256 caf12dc6939adf8fd71cdb2341a6509841ac338b734812d4fb6c2b9ff6db9e9c
MD5 cc24ad94decbeb66524661ad205cedaa
SHA1 e159325a4b4aaef91e26df95492f5ba6a94cd371
SHA512 6ca2d8c2ab2a669053330543fdeacfec42e48dfde9a4ac655f5187101dac8e6be66d272773385a32fd21fd9867f30eb12bd96e39af0191dd722540fc5703d904
SSDEEP 6144:LAmH5v2jeGOiFNa9fBx5uaNOcPQYislCjnuFHgaNdEJBoimYuZuTgsFOOwzzU:LA+YeiFNEjFcuFPdEfomwu8s
TLSH
T19FE46D1AB7A411FDD0B7C17ACD424926F7B27C475772A78B03E04AA61F2B6605E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

306124

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

winhttp

WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpConnect WinHttpQueryHeaders WinHttpCrackUrl

kernel32

GetSystemInfo GetWindowsDirectoryA HeapAlloc GetProcessHeap GlobalMemoryStatusEx GetComputerNameA Sleep SetEndOfFile SetFileAttributesW GetLastError SetFilePointerEx FlushFileBuffers FindFirstFileExW GetFileAttributesW GetLogicalDrives TerminateProcess OpenProcess QueryDosDeviceW GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoA SetProcessShutdownParameters SetThreadPriority GetModuleHandleW WaitForSingleObject CreateEventW SetEvent GetWindowsDirectoryW LocalAlloc WriteProcessMemory GetExitCodeThread K32GetModuleInformation VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx VirtualQueryEx QueryFullProcessImageNameW DuplicateHandle GetFileTime GetConsoleMode GetVolumeNameForVolumeMountPointA GetVolumeInformationA LocalFree HeapFree GetConsoleOutputCP HeapReAlloc GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent MoveFileW DeleteFileW GetFileAttributesExW CreateFileW FindClose WriteFile FindNextFileW GetFileSizeEx FindFirstFileW ReadFile CreateDirectoryW WideCharToMultiByte MultiByteToWideChar CreateProcessW GetModuleFileNameW GetProcAddress LoadLibraryW CloseHandle GetUserDefaultLangID GetCurrentProcess SetPriorityClass GetDiskFreeSpaceExW GetLogicalDriveStringsW GetCommandLineW ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind SetStdHandle HeapSize WriteConsoleW OutputDebugStringW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RaiseException RtlPcToFileHeader QueryPerformanceFrequency QueryPerformanceCounter GetNativeSystemInfo WaitForSingleObjectEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetStringTypeW

iphlpapi

GetAdaptersInfo GetAdaptersAddresses

wevtapi

EvtOpenChannelEnum EvtClose EvtNextChannelPath

ntdll

NtQueryObject NtCompareTokens NtClose NtOpenProcess NtTerminateThread NtQuerySystemInformation NtQueryInformationFile RtlCreateUserThread RtlGetVersion NtDuplicateObject NtWaitForSingleObject NtCreateEvent NtSetEvent NtClearEvent RtlEqualString RtlEqualUnicodeString RtlInitUnicodeString NtQueryInformationProcess RtlGetNtVersionNumbers

bcrypt

BCryptDecrypt BCryptGetProperty BCryptDestroyKey BCryptGenRandom BCryptSetProperty BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

vssapi

VssFreeSnapshotPropertiesInternal CreateVssBackupComponentsInternal

advapi32

RegOpenKeyExW CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptSetKeyParam CryptImportKey SystemFunction027 IsTextUnicode SystemFunction033 RegQueryInfoKeyW RegEnumKeyExW RegQueryValueExW CreateWellKnownSid SetThreadToken CheckTokenMembership DuplicateTokenEx ConvertSidToStringSidW CryptAcquireContextA CryptGenRandom CryptReleaseContext AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW FreeSid CloseServiceHandle OpenSCManagerW DeleteService ControlService EnumDependentServicesW EnumServicesStatusExW QueryServiceConfigW OpenServiceW QueryServiceStatusEx ClearEventLogW CloseEventLog OpenEventLogW RegCloseKey RegGetValueA RegQueryValueExA GetUserNameA RegOpenKeyExA GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

ws2_32

setsockopt shutdown WSAConnectByNameW send recv WSACleanup closesocket inet_pton WSAStartup socket

secur32

ApplyControlToken EncryptMessage DeleteSecurityContext QueryContextAttributesW InitializeSecurityContextA FreeCredentialsHandle DecryptMessage InitializeSecurityContextW FreeContextBuffer AcquireCredentialsHandleW

shlwapi

wnsprintfW PathFileExistsW PathIsDirectoryW

user32

PostMessageW CreateWindowExW GetMessageW IsCharAlphaNumericW DestroyWindow SetWindowLongPtrW UpdateWindow ShutdownBlockReasonDestroy PostQuitMessage TranslateMessage GetWindowLongPtrW ShutdownBlockReasonCreate RegisterClassW DispatchMessageW ShowWindow DefWindowProcW

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

Name

.text

Size

483KB

Virtual Size

482KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_cc24ad94decbeb66524661ad205cedaa_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

winhttp

kernel32

iphlpapi

wevtapi

ntdll

bcrypt

vssapi

advapi32

ws2_32

secur32

shlwapi

user32

shell32

ole32

oleaut32

generic