{
  "family": "prochack",
  "sample_count": 8,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Prochack (or generic **Process Hacker** heuristics) refers to detections associated with powerful system administration and memory manipulation tools (most notably the open-source utility 'Process Hacker', now known as 'System Informer'). While these are legitimate, highly useful tools for IT professionals to monitor and debug Windows systems, they are frequently flagged by security vendors because threat actors heavily abuse them to forcefully terminate EDR solutions, dump credentials, and manipulate system memory during an attack.<br><br><b>Understanding Prochack Abuse</b><br>To an end-user, this tool is invisible unless they explicitly launched it. For a security analyst, the unapproved presence of a tool like Process Hacker on a corporate endpoint is a massive red flag. Because the tool installs a legitimate kernel-level driver (`KProcessHacker.sys`), it operates with higher privileges than the operating system itself, allowing an attacker to bypass standard Windows security boundaries and manipulate critical processes that are normally protected.<br><br><b>Execution and Legitimate Tool Abuse</b><br>Threat actors drop Prochack/Process Hacker during the post-exploitation phase (`T1105`). Because the executable and its associated kernel driver are digitally signed (often by a legitimate open-source certificate), it easily bypasses initial static analysis (`T1553.002`). The attacker uses the tool's GUI or command-line interface to perform highly destructive actions (`T1204.002`). The most common abuse is the forceful termination of Antivirus and EDR sensors (`T1562.001`), utilizing the kernel driver to bypass tamper protection. Attackers also use the tool to dump the memory of the `lsass.exe` process (`T1003.001`) to extract plaintext passwords and NTLM hashes, mimicking the behavior of Mimikatz without needing to drop the actual Mimikatz binary.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the complete subversion of endpoint security controls and the theft of privileged credentials. The primary IoC is the execution of known Process Hacker binaries (`ProcessHacker.exe`, `SystemInformer.exe`) from unusual directories (like `%Temp%`), or the installation of the `KProcessHacker.sys` kernel driver. EDR logs will flag anomalous attempts to read the memory of `lsass.exe` or forceful attempts to suspend/kill security-related services.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1003.001",
    "T1068",
    "T1553.002",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Forcefully terminating EDR)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory (Dumping passwords)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1553.002",
      "name": "Subvert Trust Controls: Code Signing (Abusing signed drivers)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation (Using the kernel driver for ring-0 access)",
      "tactic": "Privilege Escalation"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; the presence of Process Hacker indicates an attacker has already achieved interactive, administrative access to the machine.",
    "Assume the local EDR agent has been compromised or blinded by the tool's kernel driver.",
    "Enforce a mandatory password reset for all accounts that have logged into the machine, as the attacker likely used the tool to dump LSASS memory.",
    "Perform a deep forensic review to identify the initial entry vector that allowed the attacker to drop and execute the tool."
  ],
  "what_to_avoid": [
    "Do not dismiss the alert as a 'false positive' simply because Process Hacker is a known, legitimate tool; if IT did not explicitly authorize its use, it is a severe breach.",
    "Avoid relying solely on the local EDR for containment; isolate the machine at the network level."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}