Loading malware…
ProcDump is a legitimate Microsoft Sysinternals process-memory dumping utility that is widely abused during post-compromise operations on Windows systems. It is not inherently malware. Attackers use it to capture memory from the Local Security Authority Subsystem Service (LSASS), producing dumps that can subsequently be parsed with credential-extraction tools to recover passwords, password hashes, and other authentication material. ProcDump creates the memory dump rather than performing the subsequent credential parsing itself.
ProcDump is also used to support authentication-token theft. ToddyCat has used it to dump a running Microsoft Outlook process after security software blocked another token-extraction tool, enabling the recovery of Microsoft 365 access tokens for unauthorized access to corporate email.
Observed operators include APT33, APT39, Kimsuky, FamousSparrow, FIN13, HAFNIUM, Lazarus-linked actors, and ransomware operators including PARINACOTA and LockBit 3.0. Deployments include Windows workstations, domain controllers, and compromised web servers. Attackers sometimes rename the executable to obscure its identity, and supporting utilities may write ProcDump to disk before invoking it against LSASS. Its malicious use primarily supports credential access and token-based session abuse; recovered authentication material can enable subsequent access to additional accounts and systems.
14 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
When security software blocks SharpTokenFinder, the threat actors resort to using ProcDump from the Sysinternals package to dump the Outlook process memory and bypass restrictions.
A small utility that drops ProcDump on disk and uses it to dump the lsass process, probably in order to gather in-memory secrets, such as credentials.
The threat group was observed harvesting credentials on Windows machines by using renamed versions of the ProcDump executable ... for dumping the LSASS.exe process memory.
APT33 has used... ProcDump to dump credentials... FIN13 has obtained memory dumps with ProcDump to parse and extract credentials from a victim's LSASS process memory...
"Kimsuky uses ProcDump... inclusion of ProcDump in the BabyShark malware."
+8 more in the app. View in Mallory
20 distinct techniques documented for this family, organized by ATT&CK tactic.
The HAFNIUM threat group uses the following tools to help its post-compromise behaviors.
Due to mistakes on the attacker’s side, we managed to retrieve multiple files from Earth Krahang’s servers, including samples, configuration files, and log files from its attack tools.
Used Windows Management Instrumentation (WMI) ... to remotely launch a tasklist ... Then the threat actor, via WMI ... launched procdump.exe.
Tools discovered may be pentest-utilities, for tunneling (SOCKS or other), reconnaissance scanners, exploitation code, reverse shells, malware loaders or trojans. The tools Procdump, Nishang and Powercat have been reported to be used by the HAFNIUM threat actor group according to Microsoft.
The JavaScript code pulled down an obfuscated PowerShell script that was run in memory. The PowerShell script was responsible for deploying NetSupport onto the system...
The threat actor then used their access to execute procdump via a remote service creation with the intention of dumping credentials from LSASS
the attackers used a fake ChatGPT client application as bait... However, it had no user functionality – when launched, it simply displayed a blank screen.
procdump.exe ... disguised as the entity’s logging infrastructure, splunklogger.exe.
procdump.exe, which was disguised as wininit.exe ... winrar, which was also disguised as wininit.exe.
We observed the threat actors deleting their tools (Procdump, Network scanning scripts, etc.) from hosts.
The threat actor checked on the status of Microsoft Defender and then proceeded to disable it.
Some of the notable ones are: Dumping of LSASS using Task Manager and Procdump, creation of a copy of NTDS.dit using ntdsutil.exe and extraction of SAM, SECURITY and SYSTEM hives.
red team оператор выполняет credential dumping из LSASS (T1003.001) через comsvcs.dll вместо Mimikatz.
There are several different ways to dump LSASS... Another option is to dump the LSASS process with Task Manager Sekurlsa::minidump can open the dump file.
APT actors used ProcDump to conduct reconnaissance and examine spawned processes (applications in use).
The exploitation has predominantly been in the form of semi-automatic installation of webshells that seems to leave backdoors for future access, or more manual by using tools to first gather credentials and system information followed by lateral movement and further compromise.
Next, the threat actor transferred Sysinternals tool Procdump over SMB, to the ProgramData folders on multiple hosts in the environment.
This is likely an attempt to dump NTLM credential hashes for password cracking, or for pass the hash techniques.
SMB was used to transfer the various tools laterally, as needed in the environment, like procdump.exe and AnyDesk executables.
The threat actor placed a copy of procdump.exe ... on the SolarWinds Orion server.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.