Movatterモバイル変換

[0]ホーム
URL:

  1. Home
  2. Software
  3. RegDuke

RegDuke

RegDuke is a first stage implant written in .NET and used byAPT29 since at least 2017.RegDuke has been used to control a compromised machine when control of other implants on the machine was lost.[1]

ID: S0511
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 23 September 2020
Last Modified: 16 April 2025
Enterprise Layer
downloadview

Techniques Used

DomainIDNameUse
EnterpriseT1059.001Command and Scripting Interpreter:PowerShell

RegDuke can extract and execute PowerShell scripts from C2 communications.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.[1]

EnterpriseT1546.003Event Triggered Execution:Windows Management Instrumentation Event Subscription

RegDuke can persist using a WMI consumer that is launched every time a process named WINWORD.EXE is started.[1]

EnterpriseT1105Ingress Tool Transfer

RegDuke can download files from C2.[1]

EnterpriseT1112Modify Registry

RegDuke can create seemingly legitimate Registry key to store its encryption key.[1]

EnterpriseT1027Obfuscated Files or Information

RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.[1]

.003Steganography

RegDuke can hide data in images, including use of the Least Significant Bit (LSB).[1]

.011Fileless Storage

RegDuke can store its encryption key in the Registry.[1]

EnterpriseT1102.002Web Service:Bidirectional Communication

RegDuke can use Dropbox as its C2 server.[1]

Groups That Use This Software

IDNameReferences
G0016APT29

[1][2]

Campaigns

IDNameDescription
C0023Operation Ghost

ForOperation Ghost,APT29 usedRegDuke as a first-stage implant.[1]

References

×
[8]ページ先頭
©2009-2026 Movatter.jp