Loading malware…
CrackMapExec is a publicly available post-exploitation framework used primarily in Windows Active Directory environments to automate credential validation, remote command execution, reconnaissance, and lateral movement over common enterprise protocols such as SMB and WMI. It is widely used by both red teams and threat actors as a dual-use offensive tool rather than a bespoke malware family.
Observed capabilities include enumerating domain user accounts and domain group membership, discovering active hosts and machine names on a network, collecting DNS-related host information, and enumerating shared folders and associated permissions. It also supports credential attacks such as brute forcing authentication with username lists and a single password, pass-the-hash authentication over SMB, and dumping hashed passwords from LSA secrets. For execution and lateral movement, it can run remote commands through Windows Management Instrumentation and execute PowerShell remotely. It has also been used to modify Windows Registry settings related to WDigest in support of credential access.
CrackMapExec has been used by multiple intrusion sets and campaigns, including activity associated with MuddyWater/Seedworm-linked operations, APT39, and Dragonfly-related tradecraft, as well as ransomware and hands-on-keyboard intrusions where operators relied on common administrative and offensive tooling. In some cases, obfuscated variants of the tool have been deployed to reduce detection. Its role is typically post-compromise, enabling operators to scale reconnaissance, credential abuse, and lateral movement across Windows enterprise networks.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In addition to this, an obfuscated version of the publicly available CrackMapExec tool appeared to be deployed.
Prominent among the other tools used by Twelve are Cobalt Strike, Mimikatz, Chisel, BloodHound, PowerView, adPEAS, CrackMapExec, Advanced IP Scanner, and PsExec for credential theft, discovery, network mapping, and privilege escalation.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
CrackMapExec can execute PowerShell commands via WMI.
The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'
Here, we will use Crackmapexec and check if an already obtained credential can authenticate on other machines on the domain.
ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
During Operation Wocao, the threat actors enabled Wdigest by changing the HKLM\SYSTEM\ControlSet001\Control\SecurityProviders\WDigest registry value from 0 (disabled) to 1 (enabled). Wizard Spider has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest ... to force credentials to be stored in clear text in memory.
ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
During Operation Wocao, the threat actors enabled Wdigest by changing the HKLM\SYSTEM\ControlSet001\Control\SecurityProviders\WDigest registry value from 0 (disabled) to 1 (enabled). Wizard Spider has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest ... to force credentials to be stored in clear text in memory.
the threat actor was observed dropping and executing open source and free tools such as Hydra, SecretsDump, and CrackMapExec.
We can dump SAM hashes of the users on local machines... We can also dump SAM hashes using the --sam flag.
The threat actor used password-cracking techniques to obtain the plaintext passwords from obtained credential hashes. The threat actor dropped and executed open-source and free password cracking tools such as Hydra, SecretsDump, and CrackMapExec, and Python.
I used the username list TryHackMe kindly provided us back in Task 3 and threw the password found in Task 4 at it. crackmapexec smb 192.168.12.100 -u ... -p 'MegaCorp01!' ... #Alternate TTP is to password spray with kerbrute
During Operation Wocao, the threat actors enabled Wdigest by changing the HKLM\SYSTEM\ControlSet001\Control\SecurityProviders\WDigest registry value from 0 (disabled) to 1 (enabled). Wizard Spider has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest ... to force credentials to be stored in clear text in memory.
Example Attack Scenario: NTLM Relay Attack ... Responder used to carry out a poisoning attack against LLMNR, NBT-NS, and mDNS traffic, along with capturing authentication hashes. NTLMrelayX is then used to relay those authentication hashes to the list of relay targets.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
As you can see, CrackMapExec scans the whole subnet for targets and applies the credentials to all the available machines.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information.
The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.
AdFind can enumerate domain users. APT41 used built-in net commands to enumerate domain administrator users. BloodHound can collect information about domain users, including identification of domain admin accounts.
Numerous entries mention enumerating drives, logical disks, disk type, free space, or volume information; examples include 'Babuk can enumerate disk volumes,' 'Cuba can enumerate local drives,' and 'TAINTEDSCRIBE can use DriveList to retrieve drive information.'
Remote Services (T1021, Lateral Movement) работают без ограничений: RDP, SMB, WinRM - всё открыто между сегментами.
At 09:30 UTC the threat actor ran a write access test with NetExec against ADMIN$, C$, and IPC$ on every host in the domain. On each host the test wrote a file with a 10 character random name into the ADMIN$ share.
Example Attack Scenario: NTLM Relay Attack ... Responder used to carry out a poisoning attack against LLMNR, NBT-NS, and mDNS traffic, along with capturing authentication hashes. NTLMrelayX is then used to relay those authentication hashes to the list of relay targets.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Post-exploitation tool for enumerating and moving laterally in Windows/AD environments using SMB/WinRM and credential reuse.
Post-exploitation tool that can enumerate shared folders and associated permissions across a targeted network.
Post-exploitation framework used for credential access and lateral movement; here used (via lsassy) to dump LSASS memory remotely (comsvcs.dll MiniDump and WER/Out-Minidump techniques).
Collects DNS information from targeted systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.