MITRE ATT&CKsoftware (malware)
S0567 Dtrack
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2021-01-25
Description
Dtrack is spyware that was discovered in 2019 and has been used against Indian financial institutions, research facilities, and the Kudankulam Nuclear Power Plant. Dtrack shares similarities with the DarkSeoul campaign, which was attributed to Lazarus Group.
Related
Uses · MITRE ATT&CK (23)
- T1027.009 Embedded Payloads sub-technique
- T1074.001 Local Data Staging sub-technique
- T1574 Hijack Execution Flow technique
- T1059.003 Windows Command Shell sub-technique
- T1560 Archive Collected Data technique
- T1056.001 Keylogging sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.004 File Deletion sub-technique
- T1547 Boot or Logon Autostart Execution technique
- T1543.003 Windows Service sub-technique
- T1055.012 Process Hollowing sub-technique
- T1217 Browser Information Discovery technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1005 Data from Local System technique
- T1012 Query Registry technique
- T1016 System Network Configuration Discovery technique
- T1049 System Network Connections Discovery technique
- T1057 Process Discovery technique
- T1078 Valid Accounts technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
- T1129 Shared Modules technique
Referenced by MITRE ATT&CK · uses (1)
- G0032 Lazarus Group group
References
- https://www.zdnet.com/article/confirmed-north-korean-malware-found-on-indian-nuclear-plants-network/ ZDNet Dtrack
- https://www.dragos.com/threat/wassonite/ Dragos WASSONITE
- https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/ CyberBit Dtrack
- https://usa.kaspersky.com/about/press-releases/2019_dtrack-previously-unknown-spy-tool-hits-financial-institutions-and-research-centers Kaspersky Dtrack
- https://securelist.com/my-name-is-dtrack/93338/ Securelist Dtrack