{
  "family": "dumpy",
  "sample_count": 4,
  "category": "trojan",
  "description": "Trojan:Win32/Dumpy is a highly specialized malware variant designed specifically for **Credential Dumping**. Unlike a general-purpose backdoor, Dumpy has one primary objective: to extract cleartext passwords, password hashes (NTLM), and Kerberos tickets directly from the memory of the Local Security Authority Subsystem Service (`lsass.exe`) process on Windows machines.<br><br><b>Understanding Dumpy</b><br>To an end-user, a Dumpy infection is completely invisible; the system continues to operate normally. For an enterprise security team, Dumpy represents an immediate 'Code Red' escalation. The presence of this tool indicates that an attacker has already bypassed perimeter defenses, gained local administrator privileges, and is actively harvesting credentials to facilitate lateral movement across the network and escalate privileges to Domain Administrator.<br><br><b>Execution and Credential Theft Mechanics</b><br>Dumpy is almost never the initial infection vector. It is typically dropped post-exploitation by an attacker utilizing an existing backdoor (`T1105`) or executing living-off-the-land techniques via PowerShell. Upon execution, Dumpy requires `SeDebugPrivilege` to interact with `lsass.exe`. It uses Windows APIs (`MiniDumpWriteDump` or direct memory reading) to dump the memory space of the LSASS process (`T1003.001`). This memory dump contains the cryptographic secrets and hashes of any user who has recently logged into that specific machine. The attacker then parses this dump offline (using tools like Mimikatz or SecretsDump) to extract the credentials, which are then used in Pass-the-Hash (PtH) or Pass-the-Ticket (PtT) attacks against other systems on the domain.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a catastrophic breach of identity and authentication boundaries, often leading to total domain compromise. Host-based IoCs require robust EDR: look for any process (other than authorized administrative tools) attempting to open a handle to `lsass.exe` with `PROCESS_VM_READ` access rights. The creation of large, unexplained `.dmp` files in the `%Temp%` directory is a classic indicator. Network IoCs are minimal, as the dump is usually exfiltrated over an already established C2 channel.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Dumpy and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dumpy is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dumpy establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dumpy typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Dumpy compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Dumpy should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Dumpy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dumpy frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Dumpy across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Dumpy by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.001",
    "T1134.001",
    "T1003.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory",
      "tactic": "Credential Access"
    },
    {
      "id": "T1134.001",
      "name": "Access Token Manipulation: Token Impersonation/Theft (Using SeDebugPrivilege)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell (Often used to execute memory dumpers)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint to prevent the attacker from exfiltrating the memory dump or utilizing the stolen credentials for lateral movement.",
    "Assume all accounts that recently logged into the compromised machine (especially Domain Admins) are compromised; initiate an immediate password reset for those accounts.",
    "Enable Windows Defender Credential Guard (if not already active) across the enterprise to protect `lsass.exe` using virtualization-based security.",
    "Hunt across the network for 'Pass-the-Hash' activity originating from the compromised endpoint targeting domain controllers or sensitive file shares."
  ],
  "what_to_avoid": [
    "Do not assume the attack is over if Dumpy is blocked; its presence proves the attacker already has high-level administrative access to the machine.",
    "Avoid relying solely on signature-based detection for credential dumping, as attackers frequently recompile tools to change their hash and bypass static AV."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}