DumpIt

Reported Context (3)

domain password.” The attackers then moved laterally to a second host, used legitimate tooling such as DumpIt to gather system memory, and likely exfiltrated the data via an anonymous file-sharing service. Weekly Security Roundup: PAN-OS Exploitation, Langflow Attacks and Supply-Chain Threats
[T1003.001] OS Credential Dumping: LSASS Memory – DumpIt was used to capture RAM that may contain LSASS credentials (‘DumpIt captures physical RAM, including LSASS process memory’). Rapid7 Details ModeloRAT Intrusion Using Teams Lure and CVE-2023-36036
Credential theft techniques include Mimikatz, LsaRecorder, memory dumping with DumpIt + Volatility, SSMS sqlstudio.bin extraction (ssms.exe), and harvesting registry artifacts and application credentials via SuperDump Unit 42 Tracks CL-UNK-1068 Operations Targeting Asian Critical Sectors

CVE (6)

Malware (8)

People (3)

Threat Actors (4)

MITRE ATT&CK (30)

Vendors (8)

Products (15)

Tools (17)

Industries (10)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.