Freezing Passwords: A Threat Actor's Technique Uncovered

In a recent incident response case, our team discovered a threat actor using a clever technique to capture cleartext passwords on compromised systems. The attacker registered a malicious DLL as a Windows Security Package, exploiting the trust placed in these packages by the operating system.

By analyzing our case database, we found similar screenshots from two years ago that showcased the same technique being used to capture passwords. This highlights the importance of staying vigilant and monitoring systems for suspicious activity. From a hunting perspective, reading out the relevant registry key on all endpoints should be an easy task with an Endpoint Detection and Response (EDR) tool or Velociraptor.

The malicious DLL in question is mimilib.dll, which will be loaded into the lsass.exe process memory once the Security Package is registered and the system reboots. This allows the attacker to intercept all logon passwords next time someone logs onto the system or authenticates through a command-line tool like runas.exe.

Our team observed this exact technique being used in one of our latest incident response cases, where a threat actor registered a malicious DLL as a Security Package (see the screenshot below). The mimilib.dll will be registered as a Windows Security Package, making it a critical component in capturing cleartext passwords.

But how can you protect your systems from this type of attack? First and foremost, ensure that Address Space Layout Randomization (ASLR) is enabled on your Windows systems. This security mechanism helps to randomize the location of DLLs in memory, making it more difficult for attackers to find and exploit vulnerable code.

Additionally, enable Data Execution Prevention (DEP), which prevents executable memory from being written, thus preventing attackers from using buffer overflow attacks.

In conclusion, staying ahead of threat actors requires a deep understanding of their tactics and techniques. By monitoring systems for suspicious activity and enabling Windows security features like ASLR and DEP, you can help protect your organization's sensitive data from falling into the wrong hands.

Free PeStudio 9.55