Go-based Mimikatz/GoAgent variant credential-theft functionality and potential C2 tunneling


Zero‑Dwell Threat Intelligence Report

A narrative, executive‑ready view into the malware’s behavior, exposure, and reliable defenses.
Generated: 2025-11-12 22:17:21 UTC

Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

File
7krex.exe
Type
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
SHA‑1
b8e90be3121cdc8e8bc4142da28204041c034872
MD5
de61c828b0a2f82e47bddae9eec448f5
First Seen
2025-10-05 13:22:07.949974
Last Analysis
2025-10-06 12:55:09.918379
Dwell Time
0 days, 7 hours, 33 minutes

Extended Dwell Time Impact

For 23+ hours, this malware remained undetected — a half-day window that permitted the adversary to complete initial execution, establish basic persistence, and perform initial system enumeration.

Comparative Context

Industry studies report a median dwell time closer to 21–24 days. This case represents rapid detection and containment within hours rather than days.

Timeline

Time (UTC) Event Elapsed
2025-09-20 17:55:04 UTC First VirusTotal submission —
2025-10-08 14:11:35 UTC Latest analysis snapshot 17 days, 20 hours, 16 minutes
2025-11-12 22:17:21 UTC Report generation time 45 days, 13 hours, 22 minutes

Why It Matters

Every additional day of dwell time is not just an abstract number — it is attacker opportunity. Each day equates to more time for lateral movement, stealth persistence, and intelligence gathering.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 72. Detected as malicious: 58. Missed: 14. Coverage: 80.6%.

Detected Vendors

  • Xcitium
  • +57 additional vendors (names not provided)

List includes Xcitium plus an additional 57 vendors per the provided summary.

Missed Vendors

  • Acronis
  • Baidu
  • CMC
  • Jiangmin
  • MaxSecure
  • SUPERAntiSpyware
  • TACHYON
  • tehtris
  • Trapmine
  • VirIT
  • ViRobot
  • Webroot
  • Yandex
  • Zoner

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Dominant system-level operations (67.92% of behavior) suggest this malware performs deep system reconnaissance, privilege escalation, or core OS manipulation. It’s actively probing system defenses and attempting to gain administrative control.

Behavior Categories (weighted)

Weight values represent the frequency and intensity of malware interactions with specific system components. Higher weights indicate more aggressive targeting of that category. Each operation (registry access, file modification, network connection, etc.) contributes to the category’s total weight, providing a quantitative measure of the malware’s behavioral focus.

Category Weight Percentage
System 542 67.92%
File System 69 8.65%
Registry 62 7.77%
Process 58 7.27%
Network 37 4.64%
Threading 15 1.88%
Device 11 1.38%
Misc 2 0.25%
Hooking 1 0.13%
Synchronization 1 0.13%

MITRE ATT&CK Mapping

  • No MITRE ATT&CK techniques detected

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Contacted Domains

Domain IP Country ASN/Org
dist.torproject.org 204.8.99.144 United States Quintex Alliance Consulting
www.aieov.com 76.223.54.146 United States Amazon.com, Inc.
www.msftncsi.com 2.18.67.72 Europe Akamai Technologies

Observed IPs

IP Country ASN/Org
224.0.0.252 — —
239.255.255.250 — —
8.8.4.4 United States Google LLC
8.8.8.8 United States Google LLC

DNS Queries

Request Type
5isohu.com A
www.msftncsi.com A
dist.torproject.org A
www.aieov.com A

Contacted IPs

IP Country ASN/Org
224.0.0.252 — —
239.255.255.250 — —
8.8.4.4 United States Google LLC
8.8.8.8 United States Google LLC

Port Distribution

Port Count Protocols
137 1 udp
5355 5 udp
53 92 udp
3702 1 udp

UDP Packets

Source IP Dest IP Sport Dport Time Proto
192.168.56.13 192.168.56.255 137 137 3.2442679405212402 udp
192.168.56.13 224.0.0.252 49311 5355 5.7287890911102295 udp
192.168.56.13 224.0.0.252 55150 5355 3.1732230186462402 udp
192.168.56.13 224.0.0.252 60010 5355 5.183463096618652 udp
192.168.56.13 224.0.0.252 62406 5355 3.1786770820617676 udp
192.168.56.13 224.0.0.252 63527 5355 4.467015981674194 udp
192.168.56.13 239.255.255.250 52252 3702 3.182271957397461 udp
192.168.56.13 8.8.4.4 50554 53 77.9780011177063 udp
192.168.56.13 8.8.4.4 52284 53 287.44681906700134 udp
192.168.56.13 8.8.4.4 52955 53 318.27758598327637 udp
192.168.56.13 8.8.4.4 53518 53 127.55627703666687 udp
192.168.56.13 8.8.4.4 53616 53 301.85333609580994 udp
192.168.56.13 8.8.4.4 53825 53 249.71289491653442 udp
192.168.56.13 8.8.4.4 53985 53 193.05698800086975 udp
192.168.56.13 8.8.4.4 54879 53 7.698012113571167 udp
192.168.56.13 8.8.4.4 54881 53 7.011792898178101 udp
192.168.56.13 8.8.4.4 55460 53 335.43163108825684 udp
192.168.56.13 8.8.4.4 55551 53 95.13467001914978 udp
192.168.56.13 8.8.4.4 55743 53 180.97817301750183 udp
192.168.56.13 8.8.4.4 56086 53 163.7753279209137 udp
192.168.56.13 8.8.4.4 56197 53 80.40043592453003 udp
192.168.56.13 8.8.4.4 56202 53 232.54061603546143 udp
192.168.56.13 8.8.4.4 56770 53 269.11904096603394 udp
192.168.56.13 8.8.4.4 56908 53 198.16585898399353 udp
192.168.56.13 8.8.4.4 57065 53 129.44750690460205 udp
192.168.56.13 8.8.4.4 57310 53 36.83758997917175 udp
192.168.56.13 8.8.4.4 57415 53 43.66563892364502 udp
192.168.56.13 8.8.4.4 57885 53 330.55629110336304 udp
192.168.56.13 8.8.4.4 58070 53 207.49356698989868 udp
192.168.56.13 8.8.4.4 58554 53 316.2909278869629 udp
192.168.56.13 8.8.4.4 58697 53 8.33814001083374 udp
192.168.56.13 8.8.4.4 58920 53 51.52523112297058 udp
192.168.56.13 8.8.4.4 59610 53 146.60304808616638 udp
192.168.56.13 8.8.4.4 60389 53 266.83801198005676 udp
192.168.56.13 8.8.4.4 60543 53 113.1344690322876 udp
192.168.56.13 8.8.4.4 60780 53 160.32559490203857 udp
192.168.56.13 8.8.4.4 60910 53 60.8375608921051 udp
192.168.56.13 8.8.4.4 61004 53 98.7286319732666 udp
192.168.56.13 8.8.4.4 61279 53 359.36892104148865 udp
192.168.56.13 8.8.4.4 61800 53 174.7598340511322 udp
192.168.56.13 8.8.4.4 61897 53 221.94698810577393 udp
192.168.56.13 8.8.4.4 62422 53 215.38492798805237 udp
192.168.56.13 8.8.4.4 62491 53 284.024943113327 udp
192.168.56.13 8.8.4.4 62493 53 26.478296041488647 udp
192.168.56.13 8.8.4.4 62729 53 344.97797298431396 udp
192.168.56.13 8.8.4.4 62849 53 22.431094884872437 udp
192.168.56.13 8.8.4.4 62980 53 240.29107189178467 udp
192.168.56.13 8.8.4.4 63240 53 352.6032419204712 udp
192.168.56.13 8.8.4.4 64533 53 112.25938010215759 udp
192.168.56.13 8.8.4.4 64642 53 301.10312604904175 udp
192.168.56.13 8.8.4.4 64700 53 254.6660430431366 udp
192.168.56.13 8.8.4.4 64801 53 65.94703006744385 udp
192.168.56.13 8.8.4.4 64886 53 145.9003200531006 udp
192.168.56.13 8.8.8.8 50554 53 76.98173093795776 udp
192.168.56.13 8.8.8.8 52284 53 286.4473280906677 udp
192.168.56.13 8.8.8.8 52955 53 317.27531909942627 udp
192.168.56.13 8.8.8.8 53518 53 126.55673289299011 udp
192.168.56.13 8.8.8.8 53616 53 300.85386896133423 udp
192.168.56.13 8.8.8.8 53825 53 248.72372889518738 udp
192.168.56.13 8.8.8.8 53985 53 192.057697057724 udp
192.168.56.13 8.8.8.8 54879 53 8.697072982788086 udp
192.168.56.13 8.8.8.8 54881 53 8.005381107330322 udp
192.168.56.13 8.8.8.8 55460 53 334.4317970275879 udp
192.168.56.13 8.8.8.8 55551 53 94.13498997688293 udp
192.168.56.13 8.8.8.8 55743 53 179.97853207588196 udp
192.168.56.13 8.8.8.8 56086 53 162.77518606185913 udp
192.168.56.13 8.8.8.8 56197 53 79.40106201171875 udp
192.168.56.13 8.8.8.8 56202 53 231.54115104675293 udp
192.168.56.13 8.8.8.8 56770 53 268.119225025177 udp
192.168.56.13 8.8.8.8 56908 53 197.16638708114624 udp
192.168.56.13 8.8.8.8 57065 53 128.44711303710938 udp
192.168.56.13 8.8.8.8 57310 53 35.838133096694946 udp
192.168.56.13 8.8.8.8 57415 53 42.666176080703735 udp
192.168.56.13 8.8.8.8 57885 53 329.557902097702 udp
192.168.56.13 8.8.8.8 58070 53 206.49409294128418 udp
192.168.56.13 8.8.8.8 58554 53 315.2906770706177 udp
192.168.56.13 8.8.8.8 58697 53 9.338066101074219 udp
192.168.56.13 8.8.8.8 58920 53 50.52563190460205 udp
192.168.56.13 8.8.8.8 59610 53 145.6035749912262 udp
192.168.56.13 8.8.8.8 60389 53 265.83793210983276 udp
192.168.56.13 8.8.8.8 60543 53 112.13485193252563 udp
192.168.56.13 8.8.8.8 60780 53 159.32238006591797 udp
192.168.56.13 8.8.8.8 60910 53 59.83781099319458 udp
192.168.56.13 8.8.8.8 61004 53 97.7290449142456 udp
192.168.56.13 8.8.8.8 61279 53 358.3691530227661 udp
192.168.56.13 8.8.8.8 61800 53 173.76005005836487 udp
192.168.56.13 8.8.8.8 61897 53 220.947252035141 udp
192.168.56.13 8.8.8.8 62422 53 214.38451290130615 udp
192.168.56.13 8.8.8.8 62491 53 283.0251259803772 udp
192.168.56.13 8.8.8.8 62493 53 25.483032941818237 udp
192.168.56.13 8.8.8.8 62729 53 343.97884607315063 udp
192.168.56.13 8.8.8.8 62849 53 21.431857109069824 udp
192.168.56.13 8.8.8.8 62980 53 239.29150390625 udp
192.168.56.13 8.8.8.8 63240 53 351.6037769317627 udp
192.168.56.13 8.8.8.8 64533 53 111.2602310180664 udp
192.168.56.13 8.8.8.8 64642 53 300.10607409477234 udp
192.168.56.13 8.8.8.8 64700 53 253.66624808311462 udp
192.168.56.13 8.8.8.8 64801 53 64.94740009307861 udp
192.168.56.13 8.8.8.8 64886 53 144.9004499912262 udp

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.

Persistence & Policy — Registry and Services

Registry and service telemetry points to policy awareness and environment reconnaissance rather than noisy persistence. Below is a compact view of the most relevant keys and handles; expand to see the full lists where available.

Registry Opened

0

Registry Set

7

Services Started

0

Services Opened

0

Registry Opened (Top 25)

Show all (297 total)

Registry Set (Top 25)

Key Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A3D02D79-77CD-4451-9FCF-630C3D236378}\DynamicInfo —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A3D02D79-77CD-4451-9FCF-630C3D236378}\Hash —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A3D02D79-77CD-4451-9FCF-630C3D236378}\Path —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A3D02D79-77CD-4451-9FCF-630C3D236378}\Triggers —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WindowsUpdateTask\Id —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WindowsUpdateTask\Index —
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\SOFTWARE\Microsoft\HubberUMBwO\OwBMU C6 D5 28 35 D9 EC 9A B0 54 4A CA C0 47 74 D5 4C C8 E1 75 82 C6 CB 62 89 07 C5 55 B3 8F 27 69 2A 80 43 45 42 B8 E0 8B 60 F7 66 2A BB 5F 98 F6 EB 41 6D EC 34 9F 6B 90 89 2D 11 FE BA 9E 7F 4B B4 89 51 BB 4F D9 F2 4E 6B 39 D5 EB 85 35 E3 70 12 C4 37 D1 D5 45 91 C8 D4 E5 26 38 3A 56 8E F5 32 9D DC AC 6D E6 37 A6 12 68 00 21 AA 43 5F BA 8A 86 7B B1 56 A1 DE 1F F9 8B B9 E5 E6 CE 6B 9E F4 72 94 5A E2 CC 85 F9 A9 00 BC 19 69 D3 10 A4 EE EC E1 E2 DA E8 3C 09 45 54 E7 D1 6A 0A CA 6F DC 4F 00 EC E2 EF 59 58 A1 8A A5 84 11 4D 94 F6 38 46 91 19 4C FA 24 16 67 50 5D A6 24 D6 2F 22 55 7B 15 E3 85 6C 65 20 4B CD 97 38 FA 90 4B 80 FD E6 54 99 D2 C7 16 3E E1 D4 43 04 AD 2D 21 24 18 13 34 14 CD CF 25 03 13 92 69 B7 21 2D 33 65

Services Started (Top 15)

Services Opened (Top 15)

What To Do Now — Practical Defense Playbook

  • Contain unknowns: block first‑run binaries by default — signatures catch up, containment works now.
  • EDR controls: alert on keyboard hooks, screen capture APIs, VM/sandbox checks, and command‑shell launches.
  • Registry watch: flag queries/sets under policy paths (e.g., …\FipsAlgorithmPolicy\*).
  • Network rules: inspect outbound TLS to IP‑lookup services and unexpected CDN endpoints.
  • Hunt broadly: sweep endpoints for the indicators above and quarantine positives immediately.

Dwell time equals attacker opportunity. Reducing execution privileges and egress shrinks that window even when vendors disagree.

Scroll to Top