Pswdump
Overview
Executive Summary
PSWDump is a malicious HackTool and credential dumper specifically designed to extract Windows NT LAN Manager (NTLM) password hashes from the Security Account Manager (SAM) database or directly from the Local Security Authority Subsystem Service (LSASS) memory. Widely utilized by penetration testers and malicious threat actors alike, it is a critical tool for lateral movement and privilege escalation during a network breach.Technical Architecture and Exploitation
PSWDump (and its many variants like pwdump, fgdump, and components of Mimikatz) requires local administrative privileges to function. Once executed, it bypasses standard Windows security restrictions to access sensitive cryptographic data. Its core functionalities include:- Registry SAM Extraction: The tool accesses the `HKLM\SAM` and `HKLM\SYSTEM` registry hives to extract the SYSKEY (the boot key) and subsequently decrypt the NTLM hashes of all local user accounts stored in the SAM database.
- Memory Scraping (LSASS): Advanced variants can directly hook into `lsass.exe` to scrape plaintext passwords (if WDigest is enabled) or NTLM hashes of active logon sessions from volatile memory.
- Hash Cracking Preparation: The extracted hashes are formatted (typically in the `user:RID:LM:NTLM` format) and outputted to a text file, allowing the attacker to load them into offline cracking tools (like Hashcat or John the Ripper) or use them directly in Pass-the-Hash (PtH) attacks.
Threat Impact
The successful execution of PSWDump is a catastrophic failure of endpoint security. By obtaining NTLM hashes, an attacker can authenticate to other network resources without ever knowing the user's plaintext password, rapidly escalating a single compromised endpoint into a full Active Directory domain compromise.Defense and Resilience Strategies
- Credential Guard: Enable Microsoft Defender Credential Guard on all modern Windows operating systems. Credential Guard utilizes virtualization-based security (VBS) to isolate LSASS and secrets, rendering tools like PSWDump highly ineffective.
- Disable LM and WDigest: Ensure legacy authentication protocols are disabled via Group Policy. Restrict NTLM usage where possible and force Kerberos authentication.
- Behavioral EDR: Deploy EDR solutions specifically tuned to alert on processes attempting to access `lsass.exe` (Event ID 4656/4663) or unauthorized attempts to read the SAM registry hive.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1003.001 T1003.002
Tactical Mitigations
Based on the techniques used by this family, consider the following defensive strategies:
- T1003.001: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.
- T1003.002: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_PSWDUMP {
meta:
description = "Detects Pswdump (advanced_threat)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "pswdump" ascii wide nocase
$s2 = "hacktool.pswdump" ascii wide nocase
$s3 = "tool.pwdump" ascii wide nocase
$s4 = "riskware.credentialdumper" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Pswdump Activity
id: b353473f61fc8f71f9b7c0743e787b55
status: experimental
description: Detects generic indicators of the pswdump malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*pswdump*"
- "*hacktool.pswdump*"
- "*tool.pwdump*"
- "*riskware.credentialdumper*"
condition: selection
level: mediumReferences & External Analysis
- Search "pswdump" on VirusTotal (External Analysis)
Frequently Asked Questions
How do I remove the Pswdump Advanced_Threat from Windows?
Manual removal of Pswdump is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Pswdump a virus or a Advanced_Threat?
Pswdump is classified as a Advanced_Threat. Unlike traditional viruses that infect files, modern malware like Pswdump typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Pswdump infection?
Symptoms of Pswdump can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: advanced_threat)
Explore other malware families in the same category:
Protect Your Network Against Advanced_Threats
Want to prevent Pswdump and similar threats from compromising your organization? Read our comprehensive defensive guide: Suspect an Infection? What to do.
Machine-readable
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/pswdump.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.