DUSTTRAP

Malware & Tools · DUSTTRAP

· MalwareS1159 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

DUSTTRAP is a multi-stage plugin framework associated with APT41 operations with multiple components.(Citation: Google Cloud APT41 2024)

Tactic Coverage

discovery (16)stealth (7)collection (3)exfiltration (1)privilege escalation (1)credential access (1)execution (1)command and control (1)defense impairment (1)

Used By (1 groups)

G0096APT41Wicked Panda, Brass Typhoon

Techniques (29)

T1005Data from Local System

collection

T1010Application Window Discovery

discovery

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1018Remote System Discovery

discovery

T1027.009Embedded Payloads

stealth

T1027.013Encrypted/Encoded File

References

https://attack.mitre.org/software/S1159 https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust

T1041Exfiltration Over C2 Channel

exfiltration

T1055Process Injection

stealthprivilege escalation

T1056.001Keylogging

collectioncredential access

T1057Process Discovery

discovery

T1059.003Windows Command Shell

execution

T1070Indicator Removal

stealth

T1070.005Network Share Connection Removal

stealth

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1087.001Local Account

discovery

T1087.002Domain Account

discovery

T1105Ingress Tool Transfer

command and control

T1113Screen Capture

collection

T1124System Time Discovery

discovery

T1135Network Share Discovery

discovery

T1140Deobfuscate/Decode Files or Information

stealth

T1482Domain Trust Discovery

discovery

T1497.001System Checks

stealthdiscovery

T1518.001Security Software Discovery

discovery

T1615Group Policy Discovery

discovery

T1654Log Enumeration

discovery

T1685.005Clear Windows Event Logs

defense impairment