{
  "family": "pswdump",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nPSWDump is a malicious HackTool and credential dumper specifically designed to extract Windows NT LAN Manager (NTLM) password hashes from the Security Account Manager (SAM) database or directly from the Local Security Authority Subsystem Service (LSASS) memory. Widely utilized by penetration testers and malicious threat actors alike, it is a critical tool for lateral movement and privilege escalation during a network breach.\n\n<h3>Technical Architecture and Exploitation</h3>\nPSWDump (and its many variants like pwdump, fgdump, and components of Mimikatz) requires local administrative privileges to function. Once executed, it bypasses standard Windows security restrictions to access sensitive cryptographic data.\n\nIts core functionalities include:\n<ul>\n<li><strong>Registry SAM Extraction:</strong> The tool accesses the `HKLM\\SAM` and `HKLM\\SYSTEM` registry hives to extract the SYSKEY (the boot key) and subsequently decrypt the NTLM hashes of all local user accounts stored in the SAM database.</li>\n<li><strong>Memory Scraping (LSASS):</strong> Advanced variants can directly hook into `lsass.exe` to scrape plaintext passwords (if WDigest is enabled) or NTLM hashes of active logon sessions from volatile memory.</li>\n<li><strong>Hash Cracking Preparation:</strong> The extracted hashes are formatted (typically in the `user:RID:LM:NTLM` format) and outputted to a text file, allowing the attacker to load them into offline cracking tools (like Hashcat or John the Ripper) or use them directly in Pass-the-Hash (PtH) attacks.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe successful execution of PSWDump is a catastrophic failure of endpoint security. By obtaining NTLM hashes, an attacker can authenticate to other network resources without ever knowing the user's plaintext password, rapidly escalating a single compromised endpoint into a full Active Directory domain compromise.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Credential Guard:</strong> Enable Microsoft Defender Credential Guard on all modern Windows operating systems. Credential Guard utilizes virtualization-based security (VBS) to isolate LSASS and secrets, rendering tools like PSWDump highly ineffective.</li>\n<li><strong>Disable LM and WDigest:</strong> Ensure legacy authentication protocols are disabled via Group Policy. Restrict NTLM usage where possible and force Kerberos authentication.</li>\n<li><strong>Behavioral EDR:</strong> Deploy EDR solutions specifically tuned to alert on processes attempting to access `lsass.exe` (Event ID 4656/4663) or unauthorized attempts to read the SAM registry hive.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.PSWDump",
    "Tool.Pwdump",
    "Riskware.CredentialDumper"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1003.001",
    "T1003.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:31:29Z",
  "type": "HackTool",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}