Loading malware…
pwdump6 is a Windows credential-dumping tool used to extract NTLM and LanMan password hashes from target systems and can also dump password histories when available. The provided content places it among common credential theft utilities alongside Mimikatz, Windows Credential Editor (WCE), fgdump, and pwdumpX. It is associated with credential access activity against Windows systems, including interaction with LSASS and other credential stores discussed in the source material. Detection guidance in the content notes that tools such as pwdump6 may be observable via CreateRemoteThread activity into lsass.exe (for example Sysmon Event ID 8) and unsigned modules loaded into lsass.exe (for example Sysmon Event ID 7). One cited sample, consl64.exe, is described as a DLL containing a repacked version of PwDump6. The malware/tool has been observed in use by BRONZE EXPORT, a threat group targeting the entertainment and video game industries, and by menuPass, which used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT. High-confidence aliases explicitly present in the content are limited to pwdump6/PwDump6.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
consl64.exe is actually a DLL file containing a repacked version of another credential dumping tool, PwDump6. PwDump6 is able to extract NTLM and LanMan hashes from a target Windows system, and can also dump password histories if available.
BRONZE EXPORT has previously been observed using tools such as pwdump6 and Conpee, a modular plugin based RAT.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
This handy utility dumps the password database of an NT machine that is held in the NT registry (under HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account\Users) into a valid smbpasswd format file.
LSASS memory contain a lot of sensitive data that can be dumped!... There several ways: • online from ring3 – OpenProcess…; • online from ring0 – use driver for accessing LSASS memory; • offline from LSASS memory dumps; • offline from other sources, that contain LSASS memory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Credential dumping tool used against LSASS and Windows credential stores; associated with CreateRemoteThread into LSASS and dropped DLL/file artifacts.
A credential-dumping tool observed in use by BRONZE EXPORT.
Password dumping tool executed via DLL side-loading in observed activity.
A credential dumping tool repacked by APT10 to extract NTLM and LanMan hashes and password histories from Windows systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.