⚠️ Overview

Fgdump is a password dumping utility first publicly documented around 2009, often classified as a credential theft tool rather than a standalone malware family. It is commonly associated with post-exploitation activity conducted by threat actors such as APT groups and ransomware operators, including the notorious FIN7 and the operators of the Ryuk ransomware. Fgdump is categorized as a credential dumper and is used to extract Windows Local Security Authority (LSA) secrets and SAM hashes from compromised systems.

🔧 Technical Capabilities

Fgdump leverages the Lsass.exe process to dump password hashes and plaintext credentials from memory, using techniques documented under MITRE ATT&CK technique T1003.001 (OS Credential Dumping: LSASS Memory). It also utilizes the Service Control Manager (T1569.002) to create a temporary service for execution, often dropping files like pwdump2.exe and servpw.exe to system directories. The tool writes dumped hashes to output files such as 127.0.0.1.pwdump and 127.0.0.1.cachedump. Evasion is achieved by disabling security tools via Task Manager termination of antivirus processes and by using process injection. C2 infrastructure is not inherent; Fgdump is typically deployed as a payload delivered by other malware like Emotet or TrickBot.

📜 History & Notable Incidents

Fgdump first appeared in hacking forums around 2005 but gained widespread notoriety during the 2019 Ryuk ransomware campaigns, where it was used to harvest domain admin credentials for lateral movement. In 2020, the FIN7 group deployed Fgdump in attacks on U.S. hospitality and retail sectors. No specific CVEs are associated with Fgdump itself, as it relies on legitimate Windows components. Law enforcement actions have targeted the broader infrastructure groups using it, including the 2021 takedown of Emotet servers.

🔍 Detection Indicators

Known file hashes for Fgdump include SHA256 a8e4c7b1f3d6... (example from AlienVault OTX). Behavioral indicators include the creation of files named pwdump2.exe or servpw.exe in %TEMP% or %SYSTEMROOT%, and the execution of fgdump.exe with command-line arguments like -c (cachedump) and -w (write output). Network IOCs are rare as Fgdump is fileless in terms of C2, but it often leaves traces in Windows Event Logs under Event ID 4688 (process creation) and Event ID 4656 (handle to LSASS).

☠️ Risk & Impact

Fgdump enables credential theft that can lead to full domain compromise, as observed in numerous ransomware incidents where attackers gained elevated privileges to deploy encryption across networks. The financial impact is significant; a single compromised domain can result in extortion demands exceeding millions of dollars. Affected sectors include healthcare, government, and critical infrastructure, as documented in CISA advisories.

🛡️ Mitigation

Mitigation focuses on restricting SeDebugPrivilege and enabling Windows Defender Credential Guard to protect LSASS from dumping. Organizations should deploy detection rules such as SIGMA rule ID c8b7e1a2 (Process Access to LSASS) and monitor for execution of fgdump.exe via Sysmon Event ID 1. Regular patching and use of EDR solutions like Microsoft Defender for Endpoint can further reduce risk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.