MALICIOUS — mimikatz.exe
MALICIOUS — mimikatz.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Mimikatz family. 4 of 10 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
0247ab554fb2c1cf6a30c7ac26a609e310cfded2e9857e175b56475d010dd64b - SHA-1:
809e7bbc06a9c8d00d1c2812abd5fab6416ea0ff - MD5:
e6aac11b9bbd46f2b1541e65048335d2 - imphash:
54ccad29800146a9484fc134da861841 - ssdeep:
24576:0CgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODvsGl:0CI7XBE2IuF64rIlmdiiJ - TLSH:
T1A956189C8B5F1211D2BACD74BC6195ED8476F0A85079FBAC0E03CA7A8490133DDF25A6 - Submitted as: mimikatz.exe
- File type: pe · Size: 1355286 bytes
- Verdict: malicious (98/100) · Family: Mimikatz
Detections (4 of 10 engines)
- YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
- capa (capabilities): inject code into another process
- Microsoft Defender: HackTool:Win32/Mimikatz!pz
- Emsisoft (Emergency Kit): Trojan.HackTool.Mimikatz.1
MITRE ATT&CK
YARA
- Windows_Injection_Api_Combo
- Generic_Credential_Theft_Strings
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- Process injection API combination (rule
Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90 - References to browser/OS credential stores (rule
Generic_Credential_Theft_Strings) - yara signal, weight 0.60, confidence 0.90 - Microsoft Defender flagged HackTool:Win32/Mimikatz!pz (rule
HackTool:Win32/Mimikatz!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.HackTool.Mimikatz.1 (rule
Trojan.HackTool.Mimikatz.1) - engine signal, weight 0.55, confidence 0.85 - inject code into another process (rule
inject code into another process) - capa signal, weight 0.50, confidence 0.80 - access stored credentials (rule
access stored credentials) - capa signal, weight 0.50, confidence 0.80 - encrypt data (rule
encrypt data) - capa signal, weight 0.15, confidence 0.60
Dynamic analysis (windows)
106 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- edge-consumer-static.azureedge.net
- 192.168.122.106
- 192.168.122.1
- 192.168.122.255
- 224.0.0.252
- 192.168.122.105
- 239.255.255.250
Embedded URLs
- https://blog.gentilkiwi.com/mimikatz
- https://pingcastle.com
- https://mysmartlogon.com
- https://login.microsoftonline.com
Embedded domains
- gentilkiwi.com
- blog.gentilkiwi.com
- gmail.com
- pingcastle.com
- mysmartlogon.com
- login.microsoftonline.com
- searchapp.bundleassets.example
- www.msftconnecttest.com
- edge-consumer-static.azureedge.net
File paths
- c:\windows\system32\spool\drivers\%s
- C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc
More Mimikatz samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report