T1003.001 LSASS Memory in real malware
ATT&CK technique T1003.001 LSASS Memory appears in 46 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.0% of the analyzed corpus. Seven-day prevalence is rising (43 recent vs 1 prior). Most associated families: Fugrafa, Brontok, Mimikatz, Small.
Tactics: credential-access
Prevalence in the corpus
- Samples exhibiting T1003.001: 46
- Share of analyzed corpus: 0.0%
- Last 7 days: 43 · prior 7 days: 1 (rising)
Malware families using T1003.001
Example samples
- db79ee24eba89e92e85d48d397b219af73aea31e6451724a8975106ff84f00b4 - malicious
- 83358f4c1bae1867fd7f19f4fe25f035f2c49e45c2092c181ba8d7370724d6b2 - malicious
- 22fc1c55fb5d5db2ac09a63718f2c89685e04434df9067c06f4e0c2b174cf687 - malicious
- 4a5463b4e5a0907d721e9844a1204188fd0b85b6e0e2c6d428efc39a65389008 - malicious
- f82f6b23eee3b5ec2784b4510e1e716ab83228416741323823dae03c3f6bf893 - malicious
- f88161aab5bb74fdbf7c35d0be24b3187a82cde25ce4f818651fb8e3bf25c892 - malicious
- aeb5317d9ecfd982c0615147942a5f433b83f60ed5307aebf4e7b1bbad5fa464 - malicious
- 95e3b475d5943959da86c9e56016794a21bc531be140a654bd5683070344c551 - malicious
- d7cb2448c50b3f2f97efc0748b904e047be9a3bea5bcb9941fc4853ed26c4c65 - malicious
- 381e093efa9bd0b165894b03e92c57fa6d531b4268448122b5ae76c3513175ea - malicious
- 451aecde7836384a42920c1e3cd4bfe1bf49c4cba1d0fda65919e9f2c78f41de - malicious
- 5807ac14e43757ba96e5872f54d83a5209d11c5d97a4f7bb21e55d25b2e70028 - malicious
- af8e12c2c99d798e199d377af7adfaa79a18f7377af8643eac9ecb415b52973d - malicious
- c7b57228dd36d3f5ec4011db4a8b290611160bae2213ccd7e70b8e118a0004ae - malicious
- bdbd5060cd4d9e0ae016c2deb2c2a3ee1bb9e5a3209b98faa06262763b6980b2 - malicious
- 9f78722362eb22b85aecd9616701bd6b65e1658084433fc163f1a4112095a3d0 - malicious
- 0f92263d2d535863587f5956b4432dd0c50267de8bac1211de27618abe95d706 - malicious
- b86f81fc9ecba955107b14e2077db1a96043bf4625fa566336b5ef928efbd538 - malicious
- aea266cdd1179d9103fa8ca42662c8151acaab447d0c79dbd8138c776961156e - malicious
- b5c97a45f4ae2bc6b58bcdce38bbe005115ab5a22206baf8574279254a96f697 - malicious
- 942f0c439f7c7f991933bb7390c170e7d316dee51377a6d74aa514a796eea117 - malicious
- f3d192546279c14237992c5ecc05dc5926267801c87205dc474d0e348fd62507 - malicious
- 2d6e2094b5544ef80bb5a7dc73e4d7e1e0e1827fcdb1a166c757768fff57b3a0 - malicious
- 0cd7c85be37d28b127de4d45e3a8a2ab97753aea7a19c44b30e051d520f50f51 - malicious
- 330e0901e8813d07b2715acfa069563224d87e05e48a9f28ba8c2542cc249bba - malicious
Canonical technique definition: MITRE ATT&CK T1003.001 (ATT&CK v19.1, CC BY 4.0).
Frequently asked about T1003.001
- How common is ATT&CK T1003.001 (LSASS Memory) in real malware?
- ATT&CK technique T1003.001 LSASS Memory appears in 46 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.0% of the analyzed corpus. Seven-day prevalence is rising (43 recent vs 1 prior). Most associated families: Fugrafa, Brontok, Mimikatz, Small.
- Is T1003.001 becoming more common?
- Prevalence is rising: 43 samples in the last seven days against 1 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.
- Which malware families use T1003.001?
- In this corpus T1003.001 is most associated with Fugrafa (43), Brontok (1), Mimikatz (1), Small (1). Counts are analyzed samples per family in which the technique was observed.
- What share of analyzed samples use T1003.001?
- 0.0% of the publicly analyzed corpus (46 of 100981 samples) exhibits T1003.001. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.
All ATT&CK techniques in the corpus · Latest analyzed threats