{
  "family": "pswtool",
  "sample_count": 18,
  "category": "ransomware",
  "description": "HackTool:Win32/Pswtool is a broad heuristic classification for dual-use password recovery utilities (such as NirSoft's WebBrowserPassView, mimikatz, or pwdump). While legitimately used by sysadmins to recover lost credentials, these tools are routinely hijacked by Advanced Persistent Threats (APTs) and ransomware operators as part of their credential harvesting and lateral movement toolset.<br><br><b>Understanding Pswtool Classifications</b><br>To an end-user, Pswtool executables are usually invisible, dropped in the background during an attack. For incident responders, the detection of a Pswtool is a massive red flag. It indicates that an attacker has gained initial access, established a foothold, and is actively executing the 'Credential Access' phase of the attack lifecycle. These tools do not exploit zero-days; they abuse legitimate Windows features, APIs, and poorly secured local data stores (like browser profiles) to extract plaintext passwords or NTLM hashes.<br><br><b>Execution and Credential Harvesting</b><br>Attackers typically deploy Pswtools after establishing initial access via spearphishing or exploiting a vulnerable public-facing service (`T1190`). Once inside, they use living-off-the-land techniques to execute the tool, often loading it directly into memory (`T1620`) to evade static AV signatures. The tools function by dumping LSASS memory (`T1003.001`), decrypting stored credentials in web browsers (`T1555.003`), or extracting saved Wi-Fi and VPN passwords from the registry. These credentials are then exfiltrated and used to perform privilege escalation or lateral movement across the network (`T1021`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the compromise of enterprise credentials, often leading to Domain Admin access and full network compromise. EDR platforms must alert on any process attempting to access the `lsass.exe` memory space or aggressively reading browser SQLite databases. Identifying the execution of known dual-use utilities in temporary directories (`%Temp%` or `C:\\PerfLogs`) is a strong indicator of unauthorized use.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555.003",
    "T1620",
    "T1003.001",
    "T1021",
    "T1059"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory",
      "tactic": "Credential Access"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1021",
      "name": "Remote Services",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1620",
      "name": "Reflective Code Loading",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint where the Pswtool was detected; assume the local administrator credentials have been compromised.",
    "Initiate an enterprise-wide password reset for any user accounts that had active sessions on the compromised machine.",
    "Review Windows Event Logs (specifically Event ID 4624) to track lateral movement originating from the compromised host.",
    "Ensure LSA Protection (RunAsPPL) and Windows Defender Credential Guard are enabled enterprise-wide to mitigate future LSASS dumping attacks."
  ],
  "what_to_avoid": [
    "Do not assume the attack is over simply because the AV quarantined the password dumper; the attacker may have already successfully exfiltrated the hashes.",
    "Avoid relying solely on local administrator passwords that are shared across endpoints; this allows attackers to pivot immediately."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}