{
  "family": "pwdump",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nPwdump is not a malware family itself, but rather a classification for a series of legitimate, highly potent penetration testing tools (HackTools) designed specifically to extract the Security Account Manager (SAM) database from Windows operating systems. When found on a corporate endpoint outside of authorized security testing, it is a critical indicator of post-compromise activity and impending credential theft.\n\n<h3>Technical Capabilities and Abuse</h3>\nPwdump (and its successors like fgdump) are command-line utilities. They are utilized by threat actors *after* they have already achieved local Administrator or SYSTEM privileges on a compromised machine.\n\nTheir primary function is the extraction of password hashes:\n<ul>\n<li><strong>SAM Database Extraction:</strong> The Windows SAM file stores user passwords in a hashed format (LM/NTLM). Normally, the OS locks this file, preventing standard copying. Pwdump utilizes DLL injection (often targeting the `lsass.exe` process) or specialized drivers to bypass this lock and dump the hashes directly from memory or the registry.</li>\n<li><strong>Offline Cracking:</strong> Once the attacker runs Pwdump, they output the results to a text file and exfiltrate it. They can then use offline cracking tools (like Hashcat or John the Ripper) to brute-force the plaintext passwords.</li>\n<li><strong>Pass-the-Hash (PtH):</strong> Even without cracking the plaintext password, an attacker can use the extracted NTLM hashes directly in a \"Pass-the-Hash\" attack to authenticate to other servers and pivot laterally across the Active Directory domain.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of Pwdump on a system is a critical security emergency. It unequivocally indicates that an attacker has achieved elevated privileges and is actively attempting to steal domain credentials to facilitate widespread lateral movement.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the compromised machine immediately to prevent the attacker from exfiltrating the dumped hashes or using them to pivot to the Domain Controller.</li>\n<li><strong>Enterprise-Wide Credential Reset:</strong> If Pwdump was executed successfully, incident responders must assume that all local accounts (and potentially cached domain accounts) on that machine are compromised. A mandatory password reset must be enforced.</li>\n<li><strong>Hunt for the Initial Access Vector:</strong> Pwdump is a post-exploitation tool. The investigation must focus on *how* the attacker gained the administrative privileges necessary to run it in the first place (e.g., exploiting a vulnerable service, phishing a privileged user, or lateral movement from another host).</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.Pwdump",
    "Riskware.Pwdump",
    "Win32/Pwdump"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1003.002",
    "T1003.001",
    "T1550.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:35:12Z",
  "type": "HackTool / Credential Dumper",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}