Using Procdump and Mimikatz to retrieve Windows Credentials

This page will help you to use procdump and mimikatz to retrieve windows credentials stored in memory (RAM)

Dump and extract credentials from memory

Blog Single

Procdump ?! Mimikatz ?!

Mimikatz is a well known tool that can extract Windows plaintexts passwords, hashes, PIN code and kerberos tickets from memory. Mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets.

Procdump, from Sysinternals, is a command-line utility whose primary purpose is monitoring an application and generating crash dumps.


Mimikatz is largely detected by AntiVirus software : VirusTotal report gives 36 / 56.
You might do not want / cannot use it on the target.

...Solution !

As Procdump is a legitimate Microsoft tool, it's not detected by AntiVirus. The goal is to dump the lsass.exe process, which contains the credentials, and then give this dump to mimikatz.
You should have Admin rights to use it. If you don't, you can use the "at" trick.
One can dump the lsass process which contains credentials :

C:\procdump.exe -accepteula -ma lsass.exe MyDump.dmp


From there you'll have a lsass dump file, then you can copy it back from the remote host and use Mimikatz to retrieve the creds from the dump file :

mimikatz # sekurlsa::minidump lsass.dmp
Switch to minidump
mimikatz # sekurlsa::logonPasswords

Source :

Share this Post: