Technique:  Data Staged:Local Data Staging
ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.
AppleSeed can stage files in a central location prior to exfiltration.
It has stored captured credential information in a file named pi.log.
It has been known to stage files for exfiltration in a single location.
It has utilized tools to aggregate data prior to exfiltration.
Astaroth collects data in a plaintext file named r1.log before exfiltration.
Attor has staged collected data in a central upload directory prior to exfiltration.
AuTo Stealer can store collected data from an infected host to a file named Hostname_UserName.txt prior to exfiltration.
It has copied files of interest to the main drive's recycle bin.
BADNEWS copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.
BadPatch stores collected data in log files before exfiltration.
BoxCaon has created a working folder for collected files that it sends to the C2 server.
During C0015, PowerView's file share enumeration results were stored in the file c:\ProgramData\found_shares.txt.
During C0017, It copied the local SAM and SYSTEM Registry hives to a staging directory.
Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.
Carbon creates a base directory that contains the files and folders that are collected.
Catchamas stores the gathered data from the machine in .db files and .bmp files under four separate locations.
ccf32 can temporarily store files in a hidden directory on the local host.
It has staged stolen data locally on compromised hosts.
Chrommme can store captured system information locally prior to exfiltration.
Crutch has staged stolen files in the C:\AMD\Temp directory.
DarkWatchman can stage local data in the Windows Registry.
It has created a directory named "out" in the user's %AppData% folder and copied files to it.
Dtrack can save collected data to disk, different file formats, and network shares.
Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.
DustySky created folders in temp directories to host collected files before exfiltration.
Dyre has the ability to create files in a TEMP folder to act as a database to store information.
ECCENTRICBANDWAGON has stored keystrokes and screenshots within the %temp%\GoogleChrome, %temp%\Downloads, and %temp%\TrendMicroUpdate directories.
Elise creates a file in AppData\Local\Microsoft\Windows\Explorer and stores all harvested data in that file.
Exaramel for Windows specifies a path to store files scheduled for exfiltration.
It has utilized the following temporary folders on compromised Windows and Linux systems for their operations prior to exfiltration: C:\Windows\Temp and /tmp.
It scripts save memory dump data into a specific directory on hosts in the victim environment.
FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.
FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows.
FunnyDream can stage collected information including screen captures and logged keystrokes locally.
It compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.
Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.
Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.
It has stored collected date in a .tmp file.
InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.
Kazuar stages command output and collected data in files before exfiltration.
KGH_SPY can save collected system information to a file named "info" before exfiltration.
It has staged collected data files under C:\Program Files\Common Files\System\Ole DB\.
KOPILUWAK has piped the results from executed C2 commands to %TEMP%\result2.dat on the local machine.
It malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.
It has used C:\Windows\Debug and C:\Perflogs as staging directories.
LightNeuron can store email data in files and directories specified in its configuration, such as C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\.
It stores files and logs in a folder on the local drive.
MacMa has stored collected files locally before exfiltration.
Mafalda can place retrieved files into a destination directory.
MarkiRAT can store collected data locally in a created .nfo file.
It stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.
MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.
metaMain has stored the collected system files in a working directory.
Milan has saved files prior to upload from a compromised host to folders beginning with the characters a9850d2f.
Mis-Type has temporarily stored collected information to the files "%AppData%\{Unique Identifier}\HOSTRURKLSR" and "%AppData%\{Unique Identifier}\NEWERSSEMP".
MoonWind saves information from its keylogging routine as a .zip file in the present working directory.
It has stored a decoy PDF file within a victim's %temp% folder.
It has stored collected credential files in c:\windows\temp prior to exfiltration. It has also stored documents for exfiltration in a hidden folder on USB drives.
NavRAT writes multiple outputs to a TMP file using the >> method.
NETWIRE has the ability to write collected data to a file created in the ./LOGS directory.
NightClub has copied captured files and keystrokes to the %TEMP% directory of compromised hosts.
NOKKI can collect data from the victim and stage it in LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp.
ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.
Octopus has stored collected information in the Application Data directory on a compromised host.
OopsIE stages the output from command execution and collected files in specific folders before exfiltration.
During Operation Honeybee, stolen data was copied into a text file using the format From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt prior to compression, encoding, and exfiltration.
During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration.
It copied all targeted files to a directory called index that was eventually uploaded to the C&C server.
PoisonIvy stages collected data in a text file.
PowerLess can stage stolen browser data in C:\\Windows\\Temp\\cup.tmp and keylogger data in C:\\Windows\\Temp\\Report.06E17A5A-7325-4325-8E5D-E172EBA7FC5BK.
Prikormka creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.
Pteranodon creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories. It also creates a folder at C:\Users\\AppData\Roaming\Microsoft\store to store screenshot JPEG files.
PUNCHBUGGY has saved information to a random temp file before exfil.
PUNCHTRACK aggregates collected data in a tmp file.
QakBot has stored stolen emails and other data into new folders prior to exfiltration.
RainyDay can use a file exfiltration tool to copy files to C:\ProgramData\Adobe\temp prior to exfiltration.
Ramsay can stage data prior to exfiltration in %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache.
Data captured by RawPOS is placed in a temporary file under a directory named "memdump".
Rover copies files from removable drives to C:\system.
It has collected stolen files in a temporary folder in preparation for exfiltration.
SombRAT can store harvested data in a custom database under the %TEMP% directory.
SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.
STARWHALE has stored collected data in a file called stari.txt.
SUGARDUMP has stored collected data under %<malware_execution_folder>%\\CrashLog.txt.
It has aggregated collected credentials in text files before exfiltrating.
It has created staging folders in directories that were infrequently used by legitimate users or processes.
It has locally staged encrypted archives for later exfiltration efforts.
Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.
Turian can store copied files in a specific directory prior to exfiltration.
Ursnif has used tmp files to stage gathered information.
USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.
It has saved stolen files including the ntds.dit database and the SYSTEM and SECURITY Registry hives locally to the C:\Windows\Temp\ directory.
It has staged ZIP files in local directories such as, C:\PerfLogs\1\ and C:\User\1\ prior to exfiltration.
Zebrocy stores all collected information in a single file before exfiltration.