MALICIOUS — load14.exe

MALICIOUS — load14.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mimikatz family. 5 of 38 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

• SHA-256: fb0ef32fe8c05b1f611780f42e10d5cf1dd1ca9134f662740af275054794a20b
• SHA-1: ac6556c7793507c0618772e6e89d5258a9abc4a8
• MD5: 53f81299afa6026c8ea6e7691cccdb5f
• imphash: 54ccad29800146a9484fc134da861841
• ssdeep: 24576:0CgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODvsGY:0CI7XBE2IuF64rIlmdii8
• TLSH: T19B56189C8B5F1211D2BACD74BC6195ED8476F0A85079FBAC0E03CA7A8490133DDF25A6
• Submitted as: load14.exe
• File type: pe · Size: 1355292 bytes
• Verdict: malicious (100/100) · Family: Mimikatz

Detections (5 of 38 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• capa (capabilities): inject code into another process
• ClamAV (daily): Win.Dropper.Mimikatz-9778171-1
• Microsoft Defender: HackTool:Win32/Mimikatz!pz
• Emsisoft (Emergency Kit): Trojan.HackTool.Mimikatz.1

MITRE ATT&CK

• T1055
• T1555
• T1003
• T1486
• T1112

YARA

• Windows_Injection_Api_Combo
• Generic_Credential_Theft_Strings

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged Win.Dropper.Mimikatz-9778171-1 (rule Win.Dropper.Mimikatz-9778171-1) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• References to browser/OS credential stores (rule Generic_Credential_Theft_Strings) - yara signal, weight 0.60, confidence 0.90
• Microsoft Defender flagged HackTool:Win32/Mimikatz!pz (rule HackTool:Win32/Mimikatz!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.HackTool.Mimikatz.1 (rule Trojan.HackTool.Mimikatz.1) - engine signal, weight 0.55, confidence 0.85
• inject code into another process (rule inject code into another process) - capa signal, weight 0.50, confidence 0.80
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
• Extracted Mimikatz config (0 C2) - engine signal, weight 0.45, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
• Contacted 5 host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (windows)

104 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• edge-consumer-static.azureedge.net
• 192.168.122.108
• 224.0.0.252
• 192.168.122.255
• 192.168.122.1
• 239.255.255.250

Embedded URLs

• https://blog.gentilkiwi.com/mimikatz
• https://pingcastle.com
• https://mysmartlogon.com
• https://login.microsoftonline.com

Embedded domains

• gentilkiwi.com
• blog.gentilkiwi.com
• gmail.com
• pingcastle.com
• mysmartlogon.com
• login.microsoftonline.com

Embedded IP addresses

• 1.3.6.1
• 2.5.29.17
• 2.5.29.15
• 2.5.29.37
• 2.5.29.14
• 2.5.29.35
• 2.5.29.31
• 2.5.29.19
• 2.5.4.3
• 2.5.4.11
• 2.5.4.10
• 2.5.4.6
• 1.3.14.3
• 5.5.7.3
• 2.5.4.0
• 2.2.0.0

File paths

• c:\windows\system32\spool\drivers\%s
• C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc

More Mimikatz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report