Overview

overview

10

Static

static

3

63545fa195...8a.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.zip
  • Size 324KB
  • Sample261107-wn9g7azzev
  • SHA256 58d5ebfe7e2beab980e4bc1777b74b4d1e5c40b5772ed66b1bf66cb5a77aa02d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
mimikatzbootkitdefense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Targets

    • Target
      63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.exe
    • Size 390KB
    • SHA256 63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bootkitdefense_evasiondiscoveryexecutionmimikatzpersistencespywarestealer

    • Family: Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks