{
  "family": "dumpy",
  "sample_count": 4,
  "category": "trojan",
  "description": "Trojan:Win32/Dumpy is a highly specialized malware variant designed specifically for **Credential Dumping**. Unlike a general-purpose backdoor, Dumpy has one primary objective: to extract cleartext passwords, password hashes (NTLM), and Kerberos tickets directly from the memory of the Local Security Authority Subsystem Service (`lsass.exe`) process on Windows machines.<br><br><b>Understanding Dumpy</b><br>To an end-user, a Dumpy infection is completely invisible; the system continues to operate normally. For an enterprise security team, Dumpy represents an immediate 'Code Red' escalation. The presence of this tool indicates that an attacker has already bypassed perimeter defenses, gained local administrator privileges, and is actively harvesting credentials to facilitate lateral movement across the network and escalate privileges to Domain Administrator.<br><br><b>Execution and Credential Theft Mechanics</b><br>Dumpy is almost never the initial infection vector. It is typically dropped post-exploitation by an attacker utilizing an existing backdoor (`T1105`) or executing living-off-the-land techniques via PowerShell. Upon execution, Dumpy requires `SeDebugPrivilege` to interact with `lsass.exe`. It uses Windows APIs (`MiniDumpWriteDump` or direct memory reading) to dump the memory space of the LSASS process (`T1003.001`). This memory dump contains the cryptographic secrets and hashes of any user who has recently logged into that specific machine. The attacker then parses this dump offline (using tools like Mimikatz or SecretsDump) to extract the credentials, which are then used in Pass-the-Hash (PtH) or Pass-the-Ticket (PtT) attacks against other systems on the domain.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a catastrophic breach of identity and authentication boundaries, often leading to total domain compromise. Host-based IoCs require robust EDR: look for any process (other than authorized administrative tools) attempting to open a handle to `lsass.exe` with `PROCESS_VM_READ` access rights. The creation of large, unexplained `.dmp` files in the `%Temp%` directory is a classic indicator. Network IoCs are minimal, as the dump is usually exfiltrated over an already established C2 channel.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059.001",
    "T1134.001",
    "T1003.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory",
      "tactic": "Credential Access"
    },
    {
      "id": "T1134.001",
      "name": "Access Token Manipulation: Token Impersonation/Theft (Using SeDebugPrivilege)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell (Often used to execute memory dumpers)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint to prevent the attacker from exfiltrating the memory dump or utilizing the stolen credentials for lateral movement.",
    "Assume all accounts that recently logged into the compromised machine (especially Domain Admins) are compromised; initiate an immediate password reset for those accounts.",
    "Enable Windows Defender Credential Guard (if not already active) across the enterprise to protect `lsass.exe` using virtualization-based security.",
    "Hunt across the network for 'Pass-the-Hash' activity originating from the compromised endpoint targeting domain controllers or sensitive file shares."
  ],
  "what_to_avoid": [
    "Do not assume the attack is over if Dumpy is blocked; its presence proves the attacker already has high-level administrative access to the machine.",
    "Avoid relying solely on signature-based detection for credential dumping, as attackers frequently recompile tools to change their hash and bypass static AV."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}