MALICIOUS — mimikatz.exe

MALICIOUS — mimikatz.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mimikatz family. 10 of 51 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 80e03999462f36c2c69ac6498a893b40848272e7b6aa709a9a4df85c6931447a
• SHA-1: 49dc10eca5e57338306286f84c636fcc2b0e1ab7
• MD5: ecdbd6a9825ee9af813a5b7fa6a097cb
• imphash: 54ccad29800146a9484fc134da861841
• ssdeep: 24576:0CgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODvsGJ:0CI7XBE2IuF64rIlmdiiF
• TLSH: T1A656189C8B5F1211D2BACD74BC6195ED8476F0A85079FBAC0E03CA7A8490133DDF25A6
• Submitted as: mimikatz.exe
• File type: pe · Size: 1355288 bytes
• Verdict: malicious (100/100) · Family: Mimikatz

Detections (10 of 51 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• capa (capabilities): capability:credential-access
• MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
• ClamAV (daily): Win.Dropper.Mimikatz-9778171-1
• YARA: JPCERT/CC: JPCERT_Emotet
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Detect It Easy (packer/type): DIE:Microsoft Linker
• Microsoft Defender: HackTool:Win32/Mimikatz!pz
• Emsisoft (Emergency Kit): Trojan.HackTool.Mimikatz.1

MITRE ATT&CK

• T1055
• T1555
• T1003
• T1486

YARA

• Windows_Injection_Api_Combo
• Generic_Credential_Theft_Strings

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

• ClamAV (daily) flagged Win.Dropper.Mimikatz-9778171-1 (rule Win.Dropper.Mimikatz-9778171-1) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• References to browser/OS credential stores (rule Generic_Credential_Theft_Strings) - yara signal, weight 0.60, confidence 0.90
• Microsoft Defender flagged HackTool:Win32/Mimikatz!pz (rule HackTool:Win32/Mimikatz!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.HackTool.Mimikatz.1 (rule Trojan.HackTool.Mimikatz.1) - engine signal, weight 0.55, confidence 0.85
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
• encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
• inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://blog.gentilkiwi.com/mimikatz
• https://pingcastle.com
• https://mysmartlogon.com
• https://login.microsoftonline.com

Embedded domains

• gentilkiwi.com
• blog.gentilkiwi.com
• gmail.com
• pingcastle.com
• mysmartlogon.com
• login.microsoftonline.com

File paths

• c:\windows\system32\spool\drivers\%s
• C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc

More Mimikatz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report