Koadic

ChessMaster’s current iteration starts off with the familiar phishing attacks seen in the earlier campaigns that involved the use of an email with an attached malicious document using the doc, docx, rtf, csv and msg formats.

Execution matrix 2 Technique Count Frameworks WMI 1/10 • Koadic

Persistence matrix 1 Technique Count Frameworks Scheduled Task/Job 7/10

Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.

Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode.

The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory.

Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

When we tracked ChessMaster back in November, we noted that it exploited the SOAP WSDL parser vulnerability CVE-2017-8759 ... While ChessMaster still uses the previous exploit, it also added more methods to its arsenal: one exploits another vulnerability, CVE-2017-11882...

It also abuses three legitimate MS Office functions: Automatic Dynamic Data Exchange (DDEAUTO) A legitimate Microsoft Office function used in an Office file to retrieve data from another Office file

Persistence matrix 1 Technique Count Frameworks Scheduled Task/Job 7/10

Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.

Persistence matrix 2 Technique Count Framework WMI Event Subscription 4/10

Persistence matrix 1 Technique Count Frameworks Registry Run Key/Startup Folder 9/10

Persistence matrix 1 Technique Count Frameworks Scheduled Task/Job 7/10

Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

Persistence matrix 2 Technique Count Framework WMI Event Subscription 4/10

Persistence matrix 1 Technique Count Frameworks Registry Run Key/Startup Folder 9/10

The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

APT29 has use mshta to execute malicious scripts on a compromised host... APT32 has used mshta.exe for code execution... APT38 has used a renamed version of mshta.exe to execute malicious HTML files... FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.

AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.

For NOBELIUM, the beaconing transform catches the offending process, rundll32.exe, as well as the two destination IPs...

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

Cobalt Strike has the ability to load DLLs via reflective injection... Lazarus Group malware sample performs reflective DLL injection... Matryoshka uses reflective DLL injection... Netwalker DLL has been injected reflectively into the memory of a legitimate running process.

The cyber actors use Advanced Port Scanner and Advanced IP Scanner to conduct network reconnaissance, and proceed to install open source tools, such as PowerShell Empire, Koadic, and Mimikatz.

TECHNIQUES TOOLS Evasion PowerShell Batch Cred Access PowerShell Empire Koadic Mimikatz

{Variable}.user.DC Get DCName from Registry ... {Variable}.registry.read Get/Read Registry Entries

AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.

APT41 used the WMIEXEC utility to execute whoami commands on remote machines; FIN10 used Meterpreter to enumerate users on remote systems; Operation Wocao enumerated sessions and users on a remote host.

The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.

{Variable}.process.list Enumerates Process

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

{Variable}.file.getPath Get specified file path {Variable}.file.readText Reads specified text file ... {Variable}.file.readBinary Reads specified binary file.

APT1 listed connected network shares. APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$. APT41 used the net share command as part of network reconnaissance.

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

Some of the common protocols used for C2 are HTTP/S, DNS, SSH, and SMTP, as well as common cloud services like Google, Twitter, Dropbox, etc. Using common protocols and services for C2 allows adversaries to masquerade as normal network traffic and hence evade firewalls.

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."