OS Credential Dumping: Security Account Manager

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.

A number of tools can be used to retrieve the SAM file through in-memory techniques:

Alternatively, the SAM can be extracted from the Registry with Reg:

  • reg save HKLM\sam sam
  • reg save HKLM\system system

Creddump7 can then be used to process the SAM database locally to retrieve hashes.[1]

Notes: RID 500 account is the local, built-in administrator. RID 501 is the guest account.* User accounts start with a RID of 1,000+.

ID: T1003.002
Sub-technique of:  T1003
Tactic: Credential Access
Platforms: Windows
Permissions Required: SYSTEM
Data Sources: PowerShell logs, Process command-line parameters, Process monitoring
Contributors: Ed Williams, Trustwave, SpiderLabs
Version: 1.0
Created: 11 February 2020
Last Modified: 25 March 2020

Procedure Examples

Name Description
Cobalt Strike

Cobalt Strike can recover hashed passwords.[7]

CosmicDuke

CosmicDuke collects Windows account hashes.[18]

CozyCar

Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.[15]

Dragonfly 2.0

Dragonfly 2.0 dropped and executed SecretsDump to dump password hashes.[21][22]

Fgdump

Fgdump can dump Windows password hashes.[5]

gsecdump

gsecdump can dump Windows password hashes from the SAM.[3]

HOPLIGHT

HOPLIGHT has the capability to harvest credentials and passwords from the SAM database.[17]

Impacket

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.[4]

Ke3chang

Ke3chang has dumped credentials, including by using gsecdump.[25][26]

Koadic

Koadic can gather hashed passwords by dumping SAM/SECURITY hive.[6]

menuPass

menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.[19][20]

Mimikatz

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table.[9][10][11][12]

Mivast

Mivast has the capability to gather NTLM password information.[13]

Night Dragon

Night Dragon has dumped account hashes with Carbanak and cracked them with Cain & Abel.[23]

POWERTON

POWERTON has the ability to dump password hashes.[16]

pwdump

pwdump can be used to dump credentials from the SAM.[8]

Remsec

Remsec can dump the SAM database.[14]

Soft Cell

Soft Cell used reg commands to dump specific hives from the Windows Registry, such as the SAM hive, and obtain password hashes.[24]

Threat Group-3390

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.[27][28]

Mitigations

Mitigation Description
Operating System Configuration

Consider disabling or restricting NTLM.[2]

Password Policies

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

Privileged Account Management

Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.

User Training

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

Detection

Hash dumpers open the Security Accounts Manager (SAM) on the local file system (%SystemRoot%/system32/config/SAM) or create a dump of the Registry SAM key to access stored account password hashes. Some hash dumpers will open the local file system as a device and parse to the SAM table to avoid file access defenses. Others will make an in-memory copy of the SAM table before reading hashes. Detection of compromised Valid Accounts in-use by adversaries may help as well.

References

  1. F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015.
  2. Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019.
  3. US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.
  4. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  5. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  6. Twi1ight. (2015, July 11). AD-Pentest-Script - wmiexec.vbs. Retrieved June 29, 2017.
  7. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  8. US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.
  9. McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.
  10. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.
  11. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  12. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  13. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.
  14. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.