Procedure examples

Kimsuky has gathered credentials using Mimikatz and ProcDump.

Volt Typhoon has attempted to access hashed credentials from the LSASS process memory space.

APT41 has used hashdump, Mimikatz, Procdump, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.

APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.

HAFNIUM has used procdump to dump the LSASS process memory.

MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.

FIN6 has used Windows Credential Editor for credential dumping.

Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.

Sandworm Team has used its plainpwd tool, a modified version of Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.

Mustang Panda has harvested credentials from memory of lssas.exe with Mimikatz.

APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.

UNC3886 has used MiniDump to dump process memory and search for cleartext credentials.

OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.

Ke3chang has dumped credentials, including by using Mimikatz.

APT1 has been known to use credential dumping using Mimikatz.

Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.

Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.

RedCurl used LaZagne to obtain passwords from memory.

MirrorFace has dumped LSASS memory for credential access.

Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor.

Medusa Group has leveraged Mimikatz to dump LSASS to harvest credentials.

BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.

Ember Bear uses legitimate Sysinternals tools such as procdump to dump LSASS memory.

Whitefly has used Mimikatz to obtain credentials.

Agrius used tools such as Mimikatz to dump LSASS memory to capture credentials in victim environments.

APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims. They have also dumped the LSASS process memory using the MiniDump function.

APT5 has used the Task Manager process to target LSASS process memory in order to obtain NTLM password hashes. APT5 has also dumped clear text passwords and hashes from memory using Mimikatz hosted through an RDP mapped drive.

Fox Kitten has used prodump to dump credentials from LSASS.

Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.

Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.

Wizard Spider has dumped the lsass.exe memory to harvest credentials with the use of open-source tool LaZagne.

Moonstone Sleet retrieved credentials from LSASS memory.

VOID MANTICORE has dumped LSASS credentials using `comsvcs.dll` via `rundll32.exe`.

Play has used Mimikatz and the Windows Task Manager to dump LSASS process memory.

PLATINUM has used keyloggers that are also capable of dumping credentials.

Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using Mimikatz.

Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.

APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.

FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).

FIN13 has obtained memory dumps with ProcDump to parse and extract credentials from a victim's LSASS process memory with Mimikatz.

Bad Rabbit has used Mimikatz to harvest credentials from the victim's machine.

GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.

Emotet has been observed dropping and executing password grabber modules including Mimikatz.

Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.

Mafalda can dump password hashes from `LSASS.exe`.

Okrum was seen using MimikatzLite to perform credential dumping.

NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.

Pysa can perform OS credential dumping using Mimikatz.

Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.