Dtrack
- ID
- S0567
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 17 Apr 2025
Dtrack is spyware that was discovered in 2019 and has been used against Indian financial institutions, research facilities, and the Kudankulam Nuclear Power Plant. Dtrack shares similarities with the DarkSeoul campaign, which was attributed to Lazarus Group. [1][2][3][4][5]
Techniques used (23)
- T1005 Data from Local System
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1027.009 Embedded Payloads
- T1036.005 Match Legitimate Resource Name or Location
- T1049 System Network Connections Discovery
- T1055.012 Process Hollowing
- T1056.001 Keylogging
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1070.004 File Deletion
- T1074.001 Local Data Staging
- T1078 Valid Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1129 Shared Modules
- T1140 Deobfuscate/Decode Files or Information
- T1217 Browser Information Discovery
- T1543.003 Windows Service
- T1547 Boot or Logon Autostart Execution
- T1560 Archive Collected Data
- T1574 Hijack Execution Flow