Procedure examples

DUSTTRAP can gather data from infected systems.

DUSTTRAP can enumerate running application windows.

DUSTTRAP can enumerate Registry items.

DUSTTRAP can enumerate infected system network information.

DUSTTRAP can use `ping` to identify remote hosts within the victim network.

DUSTTRAP contains additional embedded DLLs and configuration files that are loaded into memory during execution.

DUSTTRAP begins with an initial launcher that decrypts an AES-128-CFB encrypted file on disk and executes it in memory.

DUSTTRAP can exfiltrate collected data over C2 channels.

DUSTTRAP compromises the `.text` section of a legitimate system DLL in `%windir%` to hold the contents of retrieved plug-ins.

DUSTTRAP can perform keylogging operations.

DUSTTRAP can enumerate running processes.

DUSTTRAP can execute commands via `cmd.exe`.

DUSTTRAP restores the `.text` section of compromised DLLs after malicious code is loaded into memory and before the file is closed.

DUSTTRAP can remove network shares from infected systems.

DUSTTRAP reads the value of the infected system's `HKLM\SYSTEM\Microsoft\Cryptography\MachineGUID` value.

DUSTTRAP can enumerate files and directories.

DUSTTRAP can enumerate local user accounts.

DUSTTRAP can enumerate domain accounts.

DUSTTRAP can retrieve and load additional payloads.

DUSTTRAP can capture screenshots.

DUSTTRAP reads the infected system's current time and writes it to a log file during execution.

DUSTTRAP can identify and enumerate victim system network shares.

DUSTTRAP deobfuscates embedded payloads.

DUSTTRAP can identify Active Directory information and related items.

DUSTTRAP decryption relies on the infected machine's `HKLM\SOFTWARE\Microsoft\Cryptography\MachineGUID` value.

DUSTTRAP can identify security software.

DUSTTRAP can identify victim environment Group Policy information.

DUSTTRAP can identify infected system log information.

DUSTTRAP can delete infected system log information.