MALICIOUS — 773635768e738bec776dfd7504164b3596e5eee344757dd1ac9a1ad19b452c86

MALICIOUS — 773635768e738bec776dfd7504164b3596e5eee344757dd1ac9a1ad19b452c86 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mimikatz family. 5 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 773635768e738bec776dfd7504164b3596e5eee344757dd1ac9a1ad19b452c86
SHA-1: 76c430b55f180a85f4e1a1e40e4a2ea37db97599
MD5: c40a2f5f25157e6a434602017531d608
imphash: 5fedb616ea298a17c62e5ea31f9b8673
ssdeep: 3072:XRAlgTTEc6KQYuYCs39Ymf5Rdbz7hzZtBNOS/MVd07KS:XRpTEc6qYM1tXV
TLSH: T15A416BFD85DB66C4DC6CF716F4F8BDDC8010E06A14E090CA66CA0875B6A10336F7A9A5
Submitted as: 773635768e738bec776dfd7504164b3596e5eee344757dd1ac9a1ad19b452c86
File type: pe · Size: 192000 bytes
Verdict: malicious (99/100) · Family: Mimikatz

Detections (5 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Znyonm!rfn
Emsisoft (Emergency Kit): Gen:Heur.Mimikatz.Marte.1

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

1 behavioral detection(s): Credential Access: LSASS memory access [critical] (rule tl-cred-lsass) - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Znyonm!rfn (rule Trojan:Win32/Znyonm!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mimikatz.Marte.1 (rule Gen:Heur.Mimikatz.Marte.1) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Extracted Mimikatz config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

302 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/5113/files/67ed89dd74a53c602c69c2ba0dcc292d295898a9a609e871861317663b856585 - 67ed89dd74a53c602c69c2ba0dcc292d295898a9a609e871861317663b856585
74f9acc911576ba45ad2c2ae46a658bcb4804662cec8eade88b3e713114f73d4 - 74f9acc911576ba45ad2c2ae46a658bcb4804662cec8eade88b3e713114f73d4
a1116ed57d207b9befed6aa58cae8e76f7205374ad39848cefdda5a20083d406 - a1116ed57d207b9befed6aa58cae8e76f7205374ad39848cefdda5a20083d406

Embedded domains

aefd.nelreports.net

More Mimikatz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report