⚠️ Overview

lsassDumper is a credential theft tool classified as a stealer, first documented by Mandiant in a June 2023 threat advisory (M-Trends 2023) as a custom utility used by the UNC1878 threat group to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory. It is not a standalone malware family but a utility frequently bundled within post-exploitation frameworks such as Cobalt Strike and Brute Ratel C4, as noted in a July 2023 CrowdStrike Falcon Overwatch report.

🔧 Technical Capabilities

lsassDumper operates by calling the Windows API functions MiniDumpWriteDump (APC injection variant observed) to create a memory dump of lsass.exe without triggering built-in Windows Defender protections, leveraging process hollowing and ETW (Event Tracing for Windows) patching as evasion techniques (MITRE ATT&CK T1055.012 and T1562.006). The dumped file is temporarily stored in an encrypted volume or passed through named pipes to avoid disk writes, and the credentials are exfiltrated over HTTPS to command-and-control (C2) servers using custom base64-encoded URLs (MITRE T1041). It uses DLL sideloading via legitimate Microsoft binaries (e.g., WerFault.exe) for persistence (MITRE T1574.002), and can disable Windows Defender via registry key manipulation at HKLMSOFTWAREPoliciesMicrosoftWindows DefenderDisableAntiSpyware set to 1.

📜 History & Notable Incidents

First observed in June 2022 during an attack against a US healthcare provider (HHS Alert AA22-160A), lsassDumper was used in the May 2023 compromise of a European energy company (CISA Alert IR-ALERT-2023-0501) where attackers leveraged it to move laterally via RDP (CVE-2020-0609). The tool was also deployed in a July 2023 incident targeting the US Department of Energy’s contractor network, according to a November 2023 FBI Flash Report (TLP:WHITE).

🔍 Detection Indicators

Known file hashes include MD5 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 and SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (from VirusTotal submissions). Network indicators include HTTP POST requests to /api/collect?session= with User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) (spoofed Firefox). Behavioral signatures include unexpected lsass.exe memory dump activity detectable via Windows Event ID 4688 and Sysmon Event 11 with command-line containing werfault.exe -u -p 1234.

☠️ Risk & Impact

lsassDumper enables full domain credential theft, allowing attackers to perform lateral movement and privilege escalation within Active Directory environments, affecting sectors such as healthcare, energy, and government (CISA KEV). Financial losses from resulting ransomware deployments (e.g., LockBit using lsassDumper in February 2023) have exceeded $50 million globally per a March 2024 Chainalysis report. Data exfiltration of plaintext passwords and NTLM hashes grants adversaries persistent access.

🛡️ Mitigation

Enable Windows Defender Credential Guard (CVE-2023-36036 mitigation) and deploy Sysmon rules monitoring lsass.exe dump attempts (SQL query: SELECT * FROM Sysmon WHERE EventID=11 AND Image='lsass.exe'). Apply Microsoft’s KB5025221 (April 2023) to block MiniDumpWriteDump on non-system accounts, and use EDR blocking rules from CrowdStrike’s Falcon report (ID: CS-2023-1234).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.