LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1159: DUSTTRAP

DUSTTRAP is a multi-stage plugin framework associated with APT41 operations with multiple components.[1]

EnterpriseS1159MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

DUSTTRAP matters because ATT&CK describes it as a Windows, multi-stage plugin framework associated with APT41 operations. The relationship set shows capabilities spanning discovery, collection, credential capture via keylogging, process injection, obfuscation, tool transfer, exfiltration over C2, and cleanup. For leaders, the practical issue is not a single malware alert; it is whether endpoint, identity, network, and IR teams can recognize a modular post-compromise toolset before discovery and collection turn into data loss.

Executive priority

Prioritize DUSTTRAP as a validation case for post-compromise resilience on Windows endpoints. Security leaders should ask whether the organization can prove visibility into command shell execution, process injection, registry and account discovery, network share enumeration, screen/key capture indicators, inbound tool transfer, C2-channel exfiltration, and evidence removal. This is also useful for audit and incident readiness: if official detection guidance is absent, local control evidence and tested response playbooks become the deciding proof of coverage.

Technical view

ATT&CK provides no official detection text for DUSTTRAP, so SOC and detection teams should build coverage from the related techniques. Validate Windows telemetry for process creation and command-line activity, registry queries, local/domain account enumeration, process and window discovery, file and directory discovery, network/share discovery, suspicious process injection behavior, encoded or embedded payload artifacts, deobfuscation activity, keylogging/screen capture indicators, tool ingress, outbound C2-like traffic, exfiltration over the same channel, and removal of share connections or other indicators. Treat the APT41 relationship as threat-intelligence context, not proof of attribution in any local incident.

Likely telemetry

  • Windows endpoint process creation, parent-child process, command-line, and script or cmd.exe execution logs
  • EDR memory and behavioral events for process injection and suspicious code execution in another process
  • Windows Registry access/query telemetry
  • File creation, modification, directory enumeration, and encoded or embedded payload artifacts
  • Local and domain account enumeration events, including use of native administration utilities where logged

Detection direction

  • Map detections to the related ATT&CK techniques rather than relying on a DUSTTRAP-specific signature, because official detection guidance is not provided.
  • Correlate multiple weak signals: discovery commands, registry queries, account/share enumeration, process discovery, and outbound communications are more meaningful together than in isolation.
  • Tune carefully for administrative false positives, especially native Windows command shell, registry, account, process, and network discovery activity.
  • Validate that obfuscation-related behaviors are visible, including embedded payloads, encrypted/encoded files, and deobfuscation/decoding activity.
  • Review blind spots around memory telemetry, keylogging/screen capture visibility, SMB/share activity, and exfiltration over an existing C2 channel.

Mitigation priorities

  • Start with visibility assurance on Windows endpoints: endpoint telemetry, command-line logging, network metadata, and retention sufficient for IR reconstruction.
  • Harden and monitor identity exposure by reviewing local and domain account enumeration visibility and limiting unnecessary privileges.
  • Reduce collection paths by reviewing access to sensitive local files and network shares, and by monitoring unusual share discovery or connection removal.
  • Control tool ingress and outbound communications through egress monitoring, proxy/firewall policy, and alerting on unusual external transfers.
  • Prepare IR playbooks for modular malware behavior: isolate affected hosts, preserve volatile and endpoint evidence, review credential exposure, and scope discovery, collection, and exfiltration activity.
Additional notes and limits

The strongest decision value comes from the relationship context: DUSTTRAP is a Windows malware object described as a multi-stage plugin framework, and its mapped techniques cover a broad post-compromise lifecycle. The official ATT&CK object does not list tactics directly and provides no detection section, so defensive planning should be technique-led and environment-specific.

This take is limited to the supplied ATT&CK STIX fields, external references, and relationships. It does not assert current exploitation, customer exposure, specific indicators, vendor detections, or confirmed attribution in any environment. Several related technique platform lists are broader than the DUSTTRAP object; the malware platform supplied here is Windows.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

DUSTTRAP

DUSTTRAP is a multi-stage plugin framework associated with APT41 operations with multiple components.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

29 rows
DomainIDNameRelationship / procedure
EnterpriseT1087.002Domain AccountSub-technique

DUSTTRAP can enumerate domain accounts.[1]

EnterpriseT1012Query Registry

DUSTTRAP can enumerate Registry items.[1]

EnterpriseT1615Group Policy Discovery

DUSTTRAP can identify victim environment Group Policy information.[1]

EnterpriseT1055Process Injection

DUSTTRAP compromises the `.text` section of a legitimate system DLL in `%windir%` to hold the contents of retrieved plug-ins.[1]

EnterpriseT1056.001KeyloggingSub-technique

DUSTTRAP can perform keylogging operations.[1]

EnterpriseT1070Indicator Removal

DUSTTRAP restores the `.text` section of compromised DLLs after malicious code is loaded into memory and before the file is closed.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

DUSTTRAP begins with an initial launcher that decrypts an AES-128-CFB encrypted file on disk and executes it in memory.[1]

EnterpriseT1057Process Discovery

DUSTTRAP can enumerate running processes.[1]

EnterpriseT1087.001Local AccountSub-technique

DUSTTRAP can enumerate local user accounts.[1]

EnterpriseT1113Screen Capture

DUSTTRAP can capture screenshots.[1]

EnterpriseT1518.001Security Software DiscoverySub-technique

DUSTTRAP can identify security software.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

DUSTTRAP deobfuscates embedded payloads.[1]

EnterpriseT1105Ingress Tool Transfer

DUSTTRAP can retrieve and load additional payloads.[1]

EnterpriseT1083File and Directory Discovery

DUSTTRAP can enumerate files and directories.[1]

EnterpriseT1005Data from Local System

DUSTTRAP can gather data from infected systems.[1]

EnterpriseT1016System Network Configuration Discovery

DUSTTRAP can enumerate infected system network information.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

DUSTTRAP can execute commands via `cmd.exe`.[1]

EnterpriseT1010Application Window Discovery

DUSTTRAP can enumerate running application windows.[1]

EnterpriseT1070.005Network Share Connection RemovalSub-technique

DUSTTRAP can remove network shares from infected systems.[1]

EnterpriseT1041Exfiltration Over C2 Channel

DUSTTRAP can exfiltrate collected data over C2 channels.[1]

EnterpriseT1124System Time Discovery

DUSTTRAP reads the infected system's current time and writes it to a log file during execution.[1]

EnterpriseT1482Domain Trust Discovery

DUSTTRAP can identify Active Directory information and related items.[1]

EnterpriseT1685.005Clear Windows Event LogsSub-technique

DUSTTRAP can delete infected system log information.[1]

EnterpriseT1082System Information Discovery

DUSTTRAP reads the value of the infected system's `HKLM\SYSTEM\Microsoft\Cryptography\MachineGUID` value.[1]

EnterpriseT1027.009Embedded PayloadsSub-technique

DUSTTRAP contains additional embedded DLLs and configuration files that are loaded into memory during execution.[1]

EnterpriseT1018Remote System Discovery

DUSTTRAP can use `ping` to identify remote hosts within the victim network.[1]

EnterpriseT1654Log Enumeration

DUSTTRAP can identify infected system log information.[1]

EnterpriseT1497.001System ChecksSub-technique

DUSTTRAP decryption relies on the infected machine's `HKLM\SOFTWARE\Microsoft\Cryptography\MachineGUID` value.[1]

EnterpriseT1135Network Share Discovery

DUSTTRAP can identify and enumerate victim system network shares.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0096: APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1087.002: Domain AccountEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1615: Group Policy DiscoveryEnterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1070: Indicator RemovalEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · CampaignC0040: APT41 DUSTEnterpriseuses · TechniqueT1087.001: Local AccountEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1010: Application Window DiscoveryEnterpriseuses · TechniqueT1070.005: Network Share Connection RemovalEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1482: Domain Trust DiscoveryEnterpriseuses · TechniqueT1685.005: Clear Windows Event LogsEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
1da59d24ce4b4a87...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle1da59d24ce4b…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  2. [2]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  3. [3]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  4. [4]
    mitre-attackS1159
    Open source URL
  5. [5]
    mitre-attackS1159
    Open source URL
  6. [6]
    mitre-attackS1159
    Open source URL
  7. [7]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  8. [8]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  9. [9]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  10. [10]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  11. [11]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  12. [12]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  13. [13]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  14. [14]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  15. [15]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  16. [16]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  17. [17]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  18. [18]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  19. [19]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  20. [20]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  21. [21]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  22. [22]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  23. [23]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  24. [24]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  25. [25]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  26. [26]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  27. [27]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  28. [28]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  29. [29]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  30. [30]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  31. [31]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  32. [32]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  33. [33]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  34. [34]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  35. [35]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  36. [36]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  37. [37]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  38. [38]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  39. [39]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  40. [40]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  41. [41]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  42. [42]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  43. [43]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  44. [44]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  45. [45]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  46. [46]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  47. [47]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  48. [48]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  49. [49]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  50. [50]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  51. [51]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  52. [52]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  53. [53]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  54. [54]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  55. [55]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  56. [56]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  57. [57]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  58. [58]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  59. [59]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  60. [60]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  61. [61]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  62. [62]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use