mimikatz | 1f2338d7b628374139d373af383a1bdec1a16b43ced015849c6be4e4d90cc2c3

General

Target
mimikatz_trunk.7z
Size 879KB
Sample261104-eyraxssw7l
SHA256 1f2338d7b628374139d373af383a1bdec1a16b43ced015849c6be4e4d90cc2c3
MD5 9b161e8fe171550ff1116c11e62b734f
SHA1 1890075e36c792d99aecb57424cffbdbcbe6215f
SHA512 e877464194c5af4a92682a4b323173a7f9940e96e7abf847dc18d63ec54d01f14d6c43f7cad44e9cae3b2a6ec0d4ab8cc9798047e839a9b1c6fb2358e309558c
SSDEEP 24576:VVS8/iDSEVeuUaR1XMuzs65mOwhkVahwu5Opo:V88/i+EVpUaR18ot6ye5Opo
TLSH
T16115339A36666B50EAFBC48B6DEA307C69433C6C5BD6926D0D767953C39CF8AC01CC04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  mimikatz_trunk.7z
- Size 879KB
- SHA256 1f2338d7b628374139d373af383a1bdec1a16b43ced015849c6be4e4d90cc2c3
- MD5 9b161e8fe171550ff1116c11e62b734f
- SHA1 1890075e36c792d99aecb57424cffbdbcbe6215f
- SHA512 e877464194c5af4a92682a4b323173a7f9940e96e7abf847dc18d63ec54d01f14d6c43f7cad44e9cae3b2a6ec0d4ab8cc9798047e839a9b1c6fb2358e309558c
- SSDEEP 24576:VVS8/iDSEVeuUaR1XMuzs65mOwhkVahwu5Opo:V88/i+EVpUaR18ot6ye5Opo
- TLSH
  T16115339A36666B50EAFBC48B6DEA307C69433C6C5BD6926D0D767953C39CF8AC01CC04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery mimikatz
- Detects Mimilove part of Mimikatz
- Family: Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- mimikatz is an open source tool to dump credentials on Windows
- Executes dropped EXE
behavioral1
- Target
  Win32/mimikatz.exe
- Size 1.0MB
- SHA256 94795fd89366e01bd6ce6471ff27c3782e2e16377a848426cf0b2e6baee9449b
- MD5 d3b17ddf0b98fd2441ed46b033043456
- SHA1 93ed68c7e5096d936115854954135d110648e739
- SHA512 cac2230361981323ea998c08f7d9afc9369c62a683a60421628adab1eb1e4ffbbc9c2239a8bf66cb662ad7d56e7284f9051bb548979b8c6862570ce45aa27120
- SSDEEP 24576:uiDjF7X3YoGq4tC1YJk+3nWBkDeq26iLutKcEY4:u05YjqakE3Aq2vu7E
- TLSH
  T13735294177E64015F5B32AB16EF2AA11CE7BB9E21831D54F029C854F0AB3D819E79B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  Win32/mimilove.exe
- Size 24KB
- SHA256 cc585d962904351ce1d92195b0fc79034dc3b13144f7c7ff24cd9f768b25e9ef
- MD5 c67f3497c310c01018f599b3eebae99e
- SHA1 d73e52e55b1ad65015886b3a01b1cc27c87e9952
- SHA512 1205b5a9a9d2f3fabcce7e53e70e4efce08b21469ae64120beaee67a828d12eeeecddc623b453105ed15990fcc7bbce53175eca6545007f9d68c0aee66e55bc0
- SSDEEP 768:LK73LxCEQskxjvDoR8a4Tj9gwF6VLCx2l/:LK5uGRl4f9dqCx2l
- TLSH
  T112B2D661AAF94125F2F21AB1FEF162028B737DD18931418F425C56CB1B73D8589ABB33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  x64/mimikatz.exe
- Size 1.3MB
- SHA256 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
- MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5
- SHA1 e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
- SHA512 f00b1ab035aa574c70f6b95b63f676fa75ff8f379f92e85ad5872c358a6bb1ed5417fdd226d421307a48653577ca42aba28103b3b2d7a5c572192d6e5f07e8b3
- SSDEEP 24576:0CgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODvsG:0CI7XBE2IuF64rIlmdii
- TLSH
  T129552901A7E90098F2B79AB59EF29516DBB378D51834C30F02A88A5F1F73F519D29732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Mimilove part of Mimikatz

Family: Mimikatz

mimikatz is an open source tool to dump credentials on Windows

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4