Threat actors have been using several methods for credential stealing, which varies based on the environment and infrastructure of the system. Most of the time, the threat actors dump the LSASS process to extract the account credentials.

Source: GBHackers