It uses 7 advanced techniques to dump LSASS memory.
Capabilities:
• Unhooked Injection (Modified Mimikatz Binary) – Utilizes unhooking to inject a modified Mimikatz binary, bypassing EDR hooks and evading detection.
• Unhooked Injection (Direct Syscalls with MDWD) – Implements direct syscalls for stealthy injection using MDWD, reducing the footprint left behind.
• Simple MiniDumpWriteDump API – Executes the straightforward MiniDumpWriteDump API method for standard LSASS memory extraction.
• MINIDUMP_CALLBACK_INFORMATION Callbacks – Uses callback functions for custom handling, offering greater control over the dumping process.
• Process Forking Technique – Forks the LSASS process, creating a memory clone and avoiding direct access to the target process.
• Direct Syscalls with MiniDumpWriteDump – Combines direct syscalls with MiniDumpWriteDump, enhancing stealth by avoiding typical API hooks.
• Native Dump with Direct Syscalls (Offline Parsing) – Leverages direct syscalls to create a native dump with essential streams for offline parsing, perfect for low-noise operations.