Procedure examples

Some versions of Pikabot build the final PE payload in memory to avoid writing contents to disk on the executing machine.

RCSession can store its obfuscated configuration file in the Registry under `HKLM\SOFTWARE\Plus` or `HKCU\SOFTWARE\Plus`.

Exaramel for Windows stores the backdoor's configuration in the Registry in XML format.

ThreatNeedle can save its configuration data as a RC4-encrypted Registry key under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.

NETWIRE can store its configuration information in the Registry under `HKCU:\Software\Netwire`.

TinyTurla can save its configuration parameters in the Registry.

PolyglotDuke can store encrypted JSON configuration files in the Registry.

RegDuke can store its encryption key in the Registry.

Volgmer stores an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.

DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.

Some versions of Chaes stored its instructions (otherwise in a `instructions.ini` file) in the Registry.

TYPEFRAME can install and store encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.

QUADAGENT stores a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications within a Registry key (such as `HKCU\Office365DCOMCheck`) in the `HKCU` hive.

Uroburos can store configuration information for the kernel driver and kernel driver loader components in an encrypted blob typically found at `HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds.`

PipeMon has stored its encrypted payload in the Registry under `HKLM\SOFTWARE\Microsoft\Print\Components\`.

Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft\[dllname].

Grandoreiro can store its configuration in the Registry at `HKCU\Software\` under frequently changing names including %USERNAME% and ToolTech-RM.

Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.

REvil can save encryption parameters and system information in the Registry.

Valak has the ability to store information regarding the C2 server and downloads in the Registry key HKCU\Software\ApplicationContainer\Appsw64.

Pillowmint has stored a compressed payload in the Registry key HKLM\SOFTWARE\Microsoft\DRM.

SysUpdate can store its encoded configuration file within Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.

CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.

ComRAT has stored encrypted orchestrator code and payloads in the Registry.

ShadowPad maintains a configuration block and virtual file system in the Registry.

QakBot can store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.

Gelsemium can store its components in the Registry.