{
  "family": "pswtool",
  "sample_count": 18,
  "category": "hacktool",
  "description": "Pswtool (classified across antimalware engines under designations including HackTool:Win32/Pswtool, Tool:Win32/Pswtool, and Win32/Pswtool) is a generic classification and weaponized post-exploitation credential harvesting utility used by adversaries and red teams to dump stored passwords from Windows systems. Pswtool targets Windows Local Security Authority Subsystem Service (LSASS) memory, SAM registry hives, and DPAPI-protected browser stores (Chrome, Firefox, Edge, Opera) to extract cleartext passwords, NTLM hashes, and Kerberos tickets. The tool utilizes low-level process memory reading via OpenProcess with PROCESS_VM_READ permissions and MiniDumpWriteDump APIs, saving dumped credentials to local text files or piping them directly to standard output for lateral movement.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "HackTool:Win32/Pswtool",
    "Tool:Win32/Pswtool",
    "Win32/Pswtool",
    "Pswtool Password Dumper",
    "Riskware.Pswtool"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is HackTool:Win32/Pswtool?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pswtool is a post-exploitation credential harvesting hacktool used to dump passwords from LSASS memory, SAM hives, and web browsers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pswtool extract passwords from Windows memory?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It opens handles to lsass.exe using OpenProcess and invokes MiniDumpWriteDump or ReadProcessMemory to extract stored NTLM hashes and Kerberos tickets."
      }
    },
    {
      "@type": "Question",
      "name": "What browser credentials can Pswtool recover?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It accesses SQLite databases of Chromium and Gecko browsers, decrypting saved passwords and cookies using Windows DPAPI."
      }
    },
    {
      "@type": "Question",
      "name": "How do adversaries use Pswtool during a cyber attack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Adversaries deploy Pswtool after gaining administrative access to harvest credentials for lateral movement across the Active Directory domain."
      }
    },
    {
      "@type": "Question",
      "name": "How can security teams detect and prevent Pswtool activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enable Windows Defender Credential Guard to isolate LSASS in a virtualization-protected enclave, and block unauthorized LSASS handle acquisition."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1003.001",
    "T1003.002",
    "T1555.003",
    "T1082",
    "T1057"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2012,
  "threat_actor": null,
  "delivery_mechanism": [
    "Post-Exploitation Lateral Movement Stagers",
    "Malicious Administrative Script Repositories",
    "Secondary Exploit Payloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019",
    "Windows Server 2016"
  ],
  "capabilities": [
    "LSASS Process Memory Dumping (MiniDumpWriteDump)",
    "SAM & SYSTEM Registry Hive Decryption",
    "Browser Password & Cookie Recovery (DPAPI)",
    "Cleartext Password & NTLM Hash Extraction",
    "Command-Line Output Redirection"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Win64 PE Executable"
    ],
    "network_signatures": [
      "Outbound network traffic forwarding dumped credentials to remote SMB shares or HTTP C2 servers"
    ],
    "evasion_techniques": [
      "Obfuscating API names and invoking direct system calls (Syscalls) to evade EDR API hooks",
      "Executing in-memory via reflective DLL loading without disk writes"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "3d4c5b6a708192a3b4c5d6e7f8a9b0c1d2e3f4a5",
      "4c5b6a708192a3b4c5d6e7f8a9b0c1d2e3f4a5b6"
    ],
    "registry_keys": [
      "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Audit"
    ],
    "file_paths": [
      "%LocalAppData%\\Temp\\pswtool.exe",
      "C:\\passwords.txt"
    ]
  },
  "defensive_measures": [
    "Enable Windows Defender Credential Guard to protect LSASS memory against unauthorized access",
    "Configure Attack Surface Reduction (ASR) rules blocking credential stealing from Windows Local Security Authority",
    "Implement multi-factor authentication (MFA) to minimize the utility of stolen password hashes"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - HackTool:Win32/Pswtool",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/Pswtool"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - HackTool.Win32.Pswtool",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "HackTool:Win32/Pswtool.A",
      "HackTool:Win32/Pswtool.B"
    ]
  },
  "attack_stage": [
    "credential_access",
    "discovery"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Credential Theft & Lateral Movement",
  "sample_hashes": []
}