Loading malware…
Dumpert is an open-source Windows credential-dumping tool developed by Outflank. It targets the Local Security Authority Subsystem Service (LSASS) process to create memory dumps from which attackers can extract credentials, password hashes, Kerberos material, and other authentication artifacts using separate tooling. Dumpert uses direct Windows system calls and API-unhooking techniques to avoid user-mode API hooks commonly deployed by endpoint security products, rather than relying solely on conventional memory-access APIs. It is frequently used alongside credential-access toolkits such as Mimikatz and ProcDump during post-compromise operations. Dumpert has been observed in intrusions targeting government environments and has been associated with credential-theft activity by threat actors including DPRK-linked Andariel/Onyx Sleet operators.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Chimera added extracted key code snippets from both Mimikatz and Dumpert to their customized Skeleton Key.
The actors employ... credential theft utilities and dual-use tools such as Mimikatz, Dumpert, and ProcDump...
6 distinct techniques documented for this family, organized by ATT&CK tactic.
SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls... re-implementing them in your own implant can bypass the triggering of those security product hooks.
« Duplication de handles depuis des services privilégiés » ; « Énumération des handles NT » pour auditer les handles ouverts sur lsass.exe.
If we, for example, want to write specific bytes, such as shellcode, into a process we can import WriteProcessMemory from the file kernel32.dll...
If we, for example, want to write specific bytes, such as shellcode, into a process we can import WriteProcessMemory from the file kernel32.dll...
« Duplication de handles depuis des services privilégiés » ; « Énumération des handles NT » pour auditer les handles ouverts sur lsass.exe.
Various security products place hooks in user-mode APIs... re-implementing them in your own implant can bypass the triggering of those security product hooks.
local and domain user credentials were collected on some key systems by dumping the LSASS process memory and extracting the credentials with Microsoft Sysinternals Procdump and Dumpert.
« Accès direct à la mémoire LSASS via Mimikatz, Dumpert, NanoDump » ; l’outil inspecte les handles ouverts sur lsass.exe et les accès PROCESS_VM_READ/PROCESS_ALL_ACCESS.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.