S1158 DUSTPAN

DUSTPAN is an in-memory dropper written in C/C++ used by APT41 since 2021 that decrypts and executes an embedded payload.¹²

Techniques Used

Domain	ID	Name	Use
enterprise	T1543	Create or Modify System Process	-
enterprise	T1543.003	Windows Service	DUSTPAN can persist as a Windows Service in operations.¹
enterprise	T1140	Deobfuscate/Decode Files or Information	DUSTPAN decodes and decrypts embedded payloads.¹
enterprise	T1036	Masquerading	-
enterprise	T1036.005	Match Legitimate Resource Name or Location	DUSTPAN is often disguised as a legitimate Windows binary such as `w3wp.exe` or `conn.exe`.¹
enterprise	T1027	Obfuscated Files or Information	-
enterprise	T1027.009	Embedded Payloads	DUSTPAN decrypts and executes an embedded payload.¹²
enterprise	T1027.013	Encrypted/Encoded File	DUSTPAN decrypts an embedded payload.¹²
enterprise	T1055	Process Injection	-
enterprise	T1055.002	Portable Executable Injection	DUSTPAN can inject its decrypted payload into another process.¹

ID	Name	References
G0096	APT41	²¹