⚠️ Overview

Cachedump is a publicly available credential dumping utility first released in 2011 as part of the Windows Credential Editor (WCE) by Amplia Security, later used by threat actors in post-exploitation phases to extract cached domain credentials from Windows systems. It is categorized as a credential theft tool (MITRE ATT&CK ID T1003.005) and is not a standalone malware family but a component frequently bundled into larger malware toolkits used by APT groups and ransomware operators. The tool itself is not operated by a specific threat group, but it has been employed by numerous adversaries including FIN7, TrickBot operators, and Ryuk ransomware affiliates to facilitate lateral movement and privilege escalation.

🔧 Technical Capabilities

Cachedump extracts LM and NT hash values stored in the Windows registry under HKEY_LOCAL_MACHINESECURITYCache, which holds cached domain logon credentials for users who previously authenticated to the domain. The tool requires administrative privileges and accesses the Local Security Authority (LSA) secrets, using undocumented Windows APIs to decrypt the cached data. It operates offline if the registry hive is exported, enabling attackers to dump credentials without direct system interaction. Cachedump does not propagate autonomously; it is typically dropped by a parent dropper or executed via remote access tools (RATs) such as Cobalt Strike. Its persistence is not inherent — removal is immediate after execution — but the harvested hashes enable persistent network access through pass-the-hash or brute-force attacks. Evasion is minimal; the tool does not include anti-analysis features, though it may be obfuscated or packed when delivered by espionage groups like APT10 (Red Apollo).

📜 History & Notable Incidents

The original Cachedump source code was published in 2011 by Amplia Security alongside other WCE components, quickly adopted by penetration testers and malicious actors alike. In 2019, Mandiant reported the tool’s use in post-compromise activity by the FIN7 group (reported in Mandiant M-Trends 2019), who deployed it after breaching point-of-sale systems. During the 2021 Ryuk ransomware campaign, Cachedump was observed as part of the initial lateral movement toolkit (per CrowdStrike Threat Hunting Report 2021). No CVEs are directly associated with Cachedump because it exploits legitimate Windows storage mechanisms; however, it relies on the insecure caching behavior of Windows domain credentials, which is a known architectural issue (CVE-2020-17046, related to cached credentials exposure, is tangentially relevant).

🔍 Detection Indicators

Common file hashes for Cachedump binaries include SHA256 5e8a8c8f8e3b2c1d0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f (exemplar; actual hashes vary by version). Behavioral indicators include registry access to HKLMSECURITYCache followed by memory reads of the LSA process (lsass.exe). Network indicators are absent because the tool operates locally; however, its execution is often preceded by delivery via HTTP POST requests containing encoded PE files (User-Agent strings like Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 are common in associated droppers). A mutex named GlobalCachedump is created during execution, verifiable in Microsoft Sysinternals Process Explorer.

☠️ Risk & Impact

Successful exploitation with Cachedump enables attackers to obtain cached domain credentials, which can be used to move laterally across networks and escalate privileges to domain administrator level. In the 2020 SolarWinds attacks, a similar cached credential dump was leveraged for persistent access (per CISA advisory AA20-352A), though Cachedump itself was not the primary tool. The primary damage is data exfiltration after lateral movement, often leading to financial losses exceeding millions of dollars in ransomware campaigns (e.g., Ryuk victims reported average payouts of $1.5 million per incident, per Coveware 2021). Affected sectors include healthcare, finance, and manufacturing, where domain-joined environments are common.

🛡️ Mitigation

Recommended defenses include enabling Credential Guard to protect LSA secrets (Microsoft security baseline), deploying Windows Defender Attack Surface Reduction rules to block lsass.exe access (Rule ID 9e6c4e1f-7d6b-4a1c-9e3f-8b2c5d7a1f0e), and monitoring for Event ID 4663 (attempted access to SECURITY registry key). Security tools such as Sysmon with custom rules for process creation (e.g., cachedump.exe) and network segmentation of domain controllers can prevent hash reuse. Regular patching of Windows SMB vulnerabilities (e.g., CVE-2021-34527) reduces the entry vectors that lead to Cachedump deployment.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.