Loading malware…
Net Crawler is a Windows malware family associated with credential theft and SMB-based lateral movement. The provided content states that it uses credential-dumping tools including Mimikatz and Windows Credential Editor (WCE) to extract cached credentials from Windows systems. For propagation and remote execution, it uses Windows administrative shares over SMB to establish authenticated sessions to remote hosts and uses PsExec for remote service manipulation to execute a copy of itself during lateral movement. High-confidence behaviors in the content therefore include credential dumping from Windows hosts, authenticated SMB/admin-share abuse, and PsExec-based remote service execution to spread within victim networks.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
"Anchor can create and execute services to load its payload"; "APT32's backdoor has used Windows services as a way to execute its malicious payload"; "Ragnar Locker has used sc.exe to execute a service that it creates"; "Shamoon creates a new service named 'ntssrv' to execute the payload"
Multiple actors and tools are described as using Mimikatz/Windows Credential Editor/LaZagne/ProcDump to “dump credentials,” often by targeting LSASS memory (e.g., “used Mimikatz to capture and use legitimate credentials,” “dumped the LSASS process memory using the MiniDump function,” “injecting itself into lsass.exe”).
"PsExec ... can be used to execute binaries on remote systems using a temporary Windows service"; "RemoteCMD can execute commands remotely by creating a new service on the remote system"; "Winexe installs a service on the remote system, executes the command, then uninstalls the service"
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware that uses PsExec/service manipulation to execute a copy of itself on remote systems for lateral movement.
Malware that performs credential theft by invoking credential dumping utilities (e.g., Mimikatz, WCE) to extract cached Windows credentials.
Tooling that leverages Windows admin shares over SMB to establish authenticated remote sessions for lateral movement.
Credential theft tool that leverages dumpers (e.g., Mimikatz/WCE) to extract cached Windows credentials.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.