Lazagne

Overview

HackTool:Win32/Lazagne is an open-source, highly versatile **Credential Dumper** and password recovery utility available on GitHub. While designed for legitimate penetration testing and sysadmin password recovery, it is almost exclusively seen in the wild as a weaponized post-exploitation tool (`T1003`). Once an attacker breaches a network, they deploy Lazagne to automatically harvest saved passwords, SSH keys, and tokens from dozens of supported applications (browsers, chat clients, databases, sysadmin tools) stored on the compromised endpoint.

Understanding the Lazagne Threat
To an IT administrator, Lazagne might seem like a useful recovery utility. To a SOC analyst, the execution of `lazagne.exe` (or its Python script equivalent) is a 'Code Red' indicator of a severe, interactive network breach. It means an attacker has bypassed perimeter defenses, escalated privileges on a host, and is now attempting to harvest credentials to pivot laterally across the enterprise domain.

Execution and Credential Harvesting Mechanics
Lazagne is typically dropped onto a victim machine *after* an initial compromise (e.g., via a phishing payload or an RDP brute-force attack) (`T1105`). The attacker usually executes it from a command shell with administrative privileges (`T1059.003`). Lazagne then automatically iterates through its modules (`T1082`). It queries the Windows Registry (`T1012`), parses SQLite databases used by browsers like Chrome and Firefox (`T1555.003`), extracts Wi-Fi profiles (`T1555.004`), and decrypts stored credentials using the Windows Data Protection API (DPAPI) (`T1555.004`). It outputs the harvested credentials in cleartext to the console or a text file for the attacker to exfiltrate.

Indicators of Compromise & Impact
The primary impact is the mass compromise of user identities, potentially granting the attacker Domain Admin privileges if an admin recently logged into the box. Host-based IoCs include EDR alerts for the execution of `lazagne.exe` (often renamed to evade simple blacklists), or alerts for anomalous processes querying multiple browser profile directories and DPAPI functions in rapid succession. The presence of a newly created `passwords.txt` or `creds.json` file in a temporary directory is a strong indicator.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1003: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_LAZAGNE_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lazagne"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "lazagne" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Lazagne (Advanced Threat) Execution & Triage
id: 34971afd-5efb-58f6-b387-c0cfe4198b83
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Lazagne malware family. Detects proxy execution, reflective DLL loading,
  and remote command injection associated with modular enterprise backdoors.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/lazagne
- https://malware-families-catalog.systemhelpdesk.com/defensive/backdoor-rat-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.advanced-threat
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1105
- attack.t1555_004
- attack.t1003
- attack.t1555_003
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \powershell.exe
    - \cmd.exe
    - \rundll32.exe
    - \regsvr32.exe
    CommandLine|contains:
    - DownloadString
    - IEX(
    - '/s /n /u /i:'
    - sc create
    - start-process
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_LAZAGNE_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lazagne tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "lazagne" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint from the network; if Lazagne was executed, an attacker has interactive control.
2. Assume all credentials stored on or entered into the compromised machine have been stolen. Force an immediate password reset for the user's Active Directory account.
3. If an IT administrator recently logged into the compromised machine via RDP or PsExec, you must assume the Domain Admin credentials were also dumped.
4. Search EDR logs enterprise-wide for the specific file hash of the Lazagne executable found, as the attacker likely deployed it to multiple machines.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow users to save corporate passwords in web browsers; enforce the use of secure, enterprise password managers that do not store credentials in easily parsed SQLite files.
2. Avoid treating Lazagne detection as a 'low severity' PUA/HackTool alert; it is a critical indicator of post-exploitation activity.

References & External Analysis

• Search "lazagne" on VirusTotal (External Analysis)
• Search "lazagne" on Any.Run (Sandbox Sandbox)
• Search "lazagne" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Advanced Threat)

Explore other documented threats in the same operational category:

• Mapsgory
• Zugo
• Spytech
• Sunnydigits
• Xyntservice
• Clickshell
• Winexe
• Opriupdater

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/lazagne.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.