mimikatz | 3342fe9ad7df194f98f06ae3b2e1d617f890b0808dfab03fffca2ee7d21bd6e8

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/10/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_a9338532bf95fb6d0c66b6395e85b304_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 1.2MB
Sample261031-pgdnlswzhy
SHA256 3342fe9ad7df194f98f06ae3b2e1d617f890b0808dfab03fffca2ee7d21bd6e8
MD5 a9338532bf95fb6d0c66b6395e85b304
SHA1 9eac4ebc0464046e66b9bc733020f90dac653640
SHA512 87056ad17aaa8ab75a9a0896382ed616c3fa1e90b845c8fd445e5c44236ff7befdda2d69018be4f18608b1c68a46cbb22b2f5a79ca97044b27eb22a0e72fa004
SSDEEP 24576:79a15xI7x07HpUavGbehZHy/m5ap6mwL8oZDF4rPCKeO/TOTvhJEuFgba97AD0+v:Q15O7x07HpUavGbefHDGNwgor4rPCVOj
TLSH
T1B7457D1DF60B5768F410957888264933C69F032736FAA8AFD9750F1F35021B68B3A96F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery mimikatz

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 2 IoCs

resource	yara_rule
behavioral1/memory/3176-0-0x0000000001480000-0x0000000001575000-memory.dmp	mimikatz
behavioral1/memory/3176-1-0x0000000001480000-0x0000000001575000-memory.dmp	mimikatz

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral1/memory/3176-0-0x0000000001480000-0x0000000001575000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/3176-1-0x0000000001480000-0x0000000001575000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_a9338532bf95fb6d0c66b6395e85b304_amadey_elex_luca-stealer_njrat_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-31_a9338532bf95fb6d0c66b6395e85b304_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_a9338532bf95fb6d0c66b6395e85b304_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3176-0-0x0000000001480000-0x0000000001575000-memory.dmp

Download

memory/3176-1-0x0000000001480000-0x0000000001575000-memory.dmp