Classe: HackTool
Les programmes HackTool sont utilisés pour créer de nouveaux utilisateurs dans la liste des visiteurs système autorisés et pour supprimer des informations des journaux système afin de masquer la présence de l'utilisateur malveillant sur le système. Ces programmes sont également utilisés pour analyser et collecter des paquets réseau pour effectuer des actions malveillantes spécifiques. Les utilisateurs malveillants utilisent des programmes HackTool lors de la configuration d'attaques sur des ordinateurs locaux ou distants.Plus d'informations
Plateforme: Win64
Win64 est une plate-forme sur les systèmes d'exploitation Windows pour l'exécution d'applications 32/64 bits. Les programmes Win64 ne peuvent pas être lancés sur des versions 32 bits de Windows.Famille: HackTool.Win64.LsassDumper
No family descriptionExamples
4B10DEF3D2406282509C05F5E7156967Tactics and Techniques: Mitre*
TA0004
Privilege Escalation
The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level, local administrator, user account with admin-like access, user accounts with access to specific system or perform specific function. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
T1068
Exploitation for Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
TA0006
Credential Access
The adversary is trying to steal account names and passwords. Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
T1003.001
LSASS Memory
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.