Google Cloud APT41 2024

DUSTTRAP can gather data from infected systems.

DUSTTRAP can enumerate running application windows.

DUSTTRAP can enumerate Registry items.

DUSTTRAP can enumerate infected system network information.

DUSTTRAP can use `ping` to identify remote hosts within the victim network.

DUSTTRAP contains additional embedded DLLs and configuration files that are loaded into memory during execution.

DUSTPAN decrypts and executes an embedded payload.

APT41 DUST used encrypted payloads decrypted and executed in memory.

DUSTTRAP begins with an initial launcher that decrypts an AES-128-CFB encrypted file on disk and executes it in memory.

DUSTPAN decrypts an embedded payload.

APT41 DUST disguised DUSTPAN as a legitimate Windows binary such as `w3wp.exe` or `conn.exe`.

DUSTPAN is often disguised as a legitimate Windows binary such as `w3wp.exe` or `conn.exe`.

DUSTTRAP can exfiltrate collected data over C2 channels.

DUSTTRAP compromises the `.text` section of a legitimate system DLL in `%windir%` to hold the contents of retrieved plug-ins.

DUSTPAN can inject its decrypted payload into another process.

DUSTTRAP can perform keylogging operations.

DUSTTRAP can enumerate running processes.

DUSTTRAP can execute commands via `cmd.exe`.

DUSTTRAP restores the `.text` section of compromised DLLs after malicious code is loaded into memory and before the file is closed.

APT41 DUST deleted various artifacts from victim systems following use.

DUSTTRAP can remove network shares from infected systems.

APT41 DUST used HTTPS for command and control.

APT41 DUST involved exporting data from Oracle databases to local CSV files prior to exfiltration.

DUSTTRAP reads the value of the infected system's `HKLM\SYSTEM\Microsoft\Cryptography\MachineGUID` value.

DUSTTRAP can enumerate files and directories.

DUSTTRAP can enumerate local user accounts.

DUSTTRAP can enumerate domain accounts.

APT41 DUST used compromised Google Workspace accounts for command and control.

APT41 DUST involved execution of `certutil.exe` via web shell to download the DUSTPAN dropper.

DUSTTRAP can retrieve and load additional payloads.

DUSTTRAP can capture screenshots.

APT41 DUST used tools such as SQLULDR2 and PINEGROVE to gather local system and database information.

DUSTTRAP reads the infected system's current time and writes it to a log file during execution.

DUSTTRAP can identify and enumerate victim system network shares.

DUSTPAN decodes and decrypts embedded payloads.

DUSTTRAP deobfuscates embedded payloads.

APT41 DUST collected data from victim Oracle databases using SQLULDR2.

DUSTTRAP can identify Active Directory information and related items.

DUSTTRAP decryption relies on the infected machine's `HKLM\SOFTWARE\Microsoft\Cryptography\MachineGUID` value.

APT41 DUST involved use of web shells such as ANTSWORD and BLUEBEAM for persistence.

DUSTTRAP can identify security software.

DUSTPAN can persist as a Windows Service in operations.

APT41 DUST used Windows Services with names such as `Windows Defend` for persistence of DUSTPAN.

APT41 DUST used stolen code signing certificates for DUSTTRAP malware and subsequent payloads.

APT41 DUST used `rar` to compress data downloaded from internal Oracle databases prior to exfiltration.

APT41 DUST exfiltrated collected information to OneDrive.

APT41 DUST used Windows services to execute DUSTPAN.

APT41 DUST used HTTPS for command and control.

APT41 DUST involved the use of DLL search order hijacking to execute DUSTTRAP. APT41 DUST used also DLL side-loading to execute DUSTTRAP via an AhnLab uninstaller.

APT41 DUST used infrastructure hosted behind Cloudflare or utilized Cloudflare Workers for command and control.