Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 4, 2024, 1:23 p.m.	Aug. 4, 2024, 1:26 p.m.

Size	32.5KB
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`80b4e71fcf1d3e41c95e608ae8258dcd`
SHA256	`8c1e685c4d74b6d3deb7cb63a3797ddaa51c7fb8451b2531a036ef8ce55219f7`
CRC32	`B67EC53A`
ssdeep	`768:Klkr5X8k9jW/Y+lIIgxRWE/6yM8bRsnsFE+W8h9Wb7tQpla:gs8fkPW46y5basFOYItQpla`
Yara	PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsDLL - (no description) IsPE64 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,DhcpServerCalloutEntry
292
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,DhcpServerCalloutEntry
  2436
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,DnsPluginInitialize
2196
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,DnsPluginInitialize
  2568
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,DnsPluginCleanup
2100
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,DnsPluginCleanup
  2720
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,DhcpNewPktHook
1188
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,DhcpNewPktHook
  2480
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,DnsPluginQuery
2288
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,DnsPluginQuery
  2652
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,ExtensionApiVersion
2388
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,ExtensionApiVersion
  2736
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,InitializeChangeNotify
2556
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,InitializeChangeNotify
  2848
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,PasswordChangeNotify
2788
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,PasswordChangeNotify
  2060
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,SpLsaModeInitialize
2952
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,SpLsaModeInitialize
  2368
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,WinDbgExtensionDllInit
884
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,WinDbgExtensionDllInit
  2492
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,coffee
2384
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,coffee
  2796
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,mimikatz
2764
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,mimikatz
  2112
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,startW
3040
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,startW
  2620
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mimilib.dll,
2400

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
111.231.145.137	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (13 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 4, 2024, 1:23 p.m.			0	0
IsDebuggerPresent Aug. 4, 2024, 1:23 p.m.			0	0
IsDebuggerPresent Aug. 4, 2024, 1:23 p.m.			0	0
IsDebuggerPresent Aug. 4, 2024, 1:23 p.m.			0	0
IsDebuggerPresent Aug. 4, 2024, 1:23 p.m.			0	0
IsDebuggerPresent Aug. 4, 2024, 1:23 p.m.			0	0
IsDebuggerPresent Aug. 4, 2024, 1:23 p.m.			0	0
IsDebuggerPresent Aug. 4, 2024, 1:23 p.m.			0	0
IsDebuggerPresent Aug. 4, 2024, 1:23 p.m.			0	0
IsDebuggerPresent Aug. 4, 2024, 1:23 p.m.			0	0
IsDebuggerPresent Aug. 4, 2024, 1:23 p.m.			0	0
IsDebuggerPresent Aug. 4, 2024, 1:23 p.m.			0	0
IsDebuggerPresent Aug. 4, 2024, 1:23 p.m.			0	0

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ Aug. 4, 2024, 1:23 p.m.	stacktrace: RtlUnhandledExceptionFilter+0x2d2 LdrQueryModuleServiceTags-0x6e ntdll+0xc40f2 @ 0x777840f2 EtwEnumerateProcessRegGuids+0x216 RtlTraceDatabaseLock-0x2a ntdll+0xc4736 @ 0x77784736 RtlQueryProcessLockInformation+0x972 RtlTraceDatabaseEnumerate-0xe ntdll+0xc5942 @ 0x77785942 RtlLogStackBackTrace+0x444 RtlTraceDatabaseCreate-0x4ec ntdll+0xc75f4 @ 0x777875f4 RtlIsDosDeviceName_U+0x7afb NtdllDialogWndProc_A-0x26c71 ntdll+0x6157b @ 0x7772157b RtlAllocateHeap+0xd9d AlpcGetMessageAttribute-0x8c3 ntdll+0x5413d @ 0x7771413d LocalFree+0x32 LocalAlloc-0x2e kernelbase+0x1582 @ 0x7fefdbf1582 rundll32+0x3023 @ 0xffe93023 rundll32+0x3b7a @ 0xffe93b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: eb 00 48 8b 9c 24 d0 00 00 00 48 81 c4 c0 00 00 exception.symbol: RtlUnhandledExceptionFilter+0x2d2 LdrQueryModuleServiceTags-0x6e ntdll+0xc40f2 exception.instruction: jmp 0x777840f4 exception.module: ntdll.dll exception.exception_code: 0xc0000374 exception.offset: 803058 exception.address: 0x777840f2 registers.r14: 0 registers.r15: 0 registers.rcx: 2354048 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2357520 registers.r11: 646 registers.r8: 5241873663099289433 registers.r9: 1160278665 registers.rdx: 2004857936 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 2002648482 registers.r13: 0	1
__exception__ Aug. 4, 2024, 1:23 p.m.	stacktrace: DhcpNewPktHook+0x34 DnsPluginQuery-0x90 mimilib+0x1220 @ 0x7fef5ee1220 rundll32+0x2f42 @ 0xffe92f42 rundll32+0x3b7a @ 0xffe93b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 66 45 8b 41 1c 4b 8d 0c 52 48 8d 05 d8 54 00 00 exception.instruction: mov r8w, word ptr [r9 + 0x1c] exception.exception_code: 0xc0000005 exception.symbol: DhcpNewPktHook+0x34 DnsPluginQuery-0x90 mimilib+0x1220 exception.address: 0x7fef5ee1220 registers.r14: 0 registers.r15: 0 registers.rcx: 262184 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309600 registers.r11: 0 registers.r8: 2146682 registers.r9: 223338299394 registers.rdx: 1309184 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 262184 registers.r13: 0	1
__exception__ Aug. 4, 2024, 1:23 p.m.	stacktrace: SpLsaModeInitialize+0x7 ExtensionApiVersion-0x150d mimilib+0x1487 @ 0x7fef5ee1487 rundll32+0x2f42 @ 0xffe92f42 rundll32+0x3b7a @ 0xffe93b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: c7 02 00 00 01 00 49 89 00 41 c7 01 01 00 00 00 exception.instruction: mov dword ptr [rdx], 0x10000 exception.exception_code: 0xc0000005 exception.symbol: SpLsaModeInitialize+0x7 ExtensionApiVersion-0x150d mimilib+0x1487 exception.address: 0x7fef5ee1487 registers.r14: 0 registers.r15: 0 registers.rcx: 590178 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1703536 registers.r11: 1702624 registers.r8: 3260836 registers.r9: 10 registers.rdx: 4293459968 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 8791629141216 registers.r13: 0	1
__exception__ Aug. 4, 2024, 1:23 p.m.	stacktrace: 0x10000 rundll32+0x2f42 @ 0xffe92f42 rundll32+0x3b7a @ 0xffe93b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 00 00 00 00 00 00 00 00 9d f6 35 d2 c4 d8 00 01 exception.instruction: add byte ptr [rax], al exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x10000 registers.r14: 0 registers.r15: 0 registers.rcx: 8791629131840 registers.rsi: 0 registers.r10: 281474976776192 registers.rbx: 0 registers.rsp: 1768128 registers.r11: 8791629143008 registers.r8: 0 registers.r9: 0 registers.rdx: 49578 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 8791629143008 registers.r13: 0	1
__exception__ Aug. 4, 2024, 1:23 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 8791629132624 registers.rsi: 0 registers.r10: 0 registers.rbx: 131572 registers.rsp: 2358600 registers.r11: 2358240 registers.r8: 4571482 registers.r9: 10 registers.rdx: 4293459968 registers.r12: 10 registers.rbp: 4571376 registers.rdi: -1 registers.rax: 131572 registers.r13: 0	1
__exception__ Aug. 4, 2024, 1:23 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 8791629132720 registers.rsi: 0 registers.r10: 0 registers.rbx: 8791629128320 registers.rsp: 2619736 registers.r11: 2619648 registers.r8: 7000 registers.r9: 10 registers.rdx: 4293459968 registers.r12: 10 registers.rbp: 3916016 registers.rdi: -1 registers.rax: 58536 registers.r13: 0	1

Communicates with host for which no DNS query was performed (1 event)

host

111.231.145.137

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Lionic	Trojan.Win64.Mimikatz.i!c
MicroWorld-eScan	Application.HackTool.Mimikatz.AC
CAT-QuickHeal	HackTool.Mimikatz.S13719267
Skyhigh	HTool-Mimikatz
ALYac	Application.HackTool.Mimikatz.AC
Cylance	Unsafe
VIPRE	Application.HackTool.Mimikatz.AC
Sangfor	HackTool.Win64.Mimikatz.uwccg
K7AntiVirus	Hacktool ( 0043c1591 )
BitDefender	Application.HackTool.Mimikatz.AC
K7GW	Hacktool ( 0043c1591 )
Arcabit	Application.HackTool.Mimikatz.AC
Symantec	Hacktool.Mimikatz
ESET-NOD32	a variant of Win64/Riskware.Mimikatz.U
McAfee	HTool-Mimikatz
Avast	Win64:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Mimikatz.gen
Alibaba	Trojan:Win32/Mimikatz.4b1
NANO-Antivirus	Trojan.Win64.Mimikatz.eusljj
Rising	HackTool.Mimikatz!1.B3A7 (CLASSIC)
Emsisoft	Application.HackTool.Mimikatz.AC (B)
DrWeb	Tool.Mimikatz.41
Zillya	Tool.Mimikatz.Win64.220
TrendMicro	HKTL_MIMIKATZ64
McAfeeD	ti!8C1E685C4D74
FireEye	Generic.mg.80b4e71fcf1d3e41
Sophos	ATK/Apteryx-Gen
Ikarus	HackTool.Mimikatz
Jiangmin	Trojan.PSW.Mimikatz.td
Webroot	W32.Hacktool.Gen
Google	Detected
MAX	malware (ai score=100)
Antiy-AVL	Trojan[PSW]/Win64.Mimikatz
Kingsoft	win32.troj.undef.a
Gridinsoft	Virtool.Win64.Mimikatz.dd!n
Xcitium	Malware@#3urk2nmtodhbg
Microsoft	HackTool:Win64/Mikatz!dha
ZoneAlarm	HEUR:Trojan.Win32.Mimikatz.gen
GData	Win32.Riskware.Mimikatz.C
AhnLab-V3	HackTool/Win64.Mimikatz.C1953096
DeepInstinct	MALICIOUS
VBA32	TrojanPSW.Win64.Mimikatz
Malwarebytes	HackTool.Mimikatz
Panda	Hacktool/Mimikatz
TrendMicro-HouseCall	HKTL_MIMIKATZ64
Tencent	Trojan.Win64.Mimikatz.a
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.9545116.susgen
Fortinet	Riskware/Mimikatz

mimilib.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All