Koadic

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial.

ChessMaster’s current iteration starts off with the familiar phishing attacks seen in the earlier campaigns that involved the use of an email with an attached malicious document using the doc, docx, rtf, csv and msg formats.

Execution matrix 2 Technique Count Frameworks WMI 1/10 • Koadic

Persistence matrix 1 Technique Count Frameworks Scheduled Task/Job 7/10

Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.

Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode.

The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory.

Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. Orz can execute commands with JavaScript. Patchwork used JavaScript code and .SCT files on victim machines. Water Curupira Pikabot Distribution installation via JavaScript will launch follow-on commands via cmd.exe.

When we tracked ChessMaster back in November, we noted that it exploited the SOAP WSDL parser vulnerability CVE-2017-8759 ... While ChessMaster still uses the previous exploit, it also added more methods to its arsenal: one exploits another vulnerability, CVE-2017-11882...

It also abuses three legitimate MS Office functions: Automatic Dynamic Data Exchange (DDEAUTO) A legitimate Microsoft Office function used in an Office file to retrieve data from another Office file

APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents.

"Anchor can create and execute services to load its payload"; "APT32's backdoor has used Windows services as a way to execute its malicious payload"; "Ragnar Locker has used sc.exe to execute a service that it creates"; "Shamoon creates a new service named 'ntssrv' to execute the payload"

Persistence matrix 1 Technique Count Frameworks Scheduled Task/Job 7/10

Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.

Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.

Persistence matrix 2 Technique Count Framework WMI Event Subscription 4/10

Persistence matrix 1 Technique Count Frameworks Registry Run Key/Startup Folder 9/10

Persistence matrix 1 Technique Count Frameworks Scheduled Task/Job 7/10

Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

Persistence matrix 2 Technique Count Framework WMI Event Subscription 4/10

Persistence matrix 1 Technique Count Frameworks Registry Run Key/Startup Folder 9/10

The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

APT29 has use mshta to execute malicious scripts on a compromised host... APT32 has used mshta.exe for code execution... APT38 has used a renamed version of mshta.exe to execute malicious HTML files... FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.

AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.

For NOBELIUM, the beaconing transform catches the offending process, rundll32.exe, as well as the two destination IPs...

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

Cobalt Strike has the ability to load DLLs via reflective injection... Lazarus Group malware sample performs reflective DLL injection... Matryoshka uses reflective DLL injection... Netwalker DLL has been injected reflectively into the memory of a legitimate running process.

Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.

The cyber actors use Advanced Port Scanner and Advanced IP Scanner to conduct network reconnaissance, and proceed to install open source tools, such as PowerShell Empire, Koadic, and Mimikatz.

TECHNIQUES TOOLS Evasion PowerShell Batch Cred Access PowerShell Empire Koadic Mimikatz

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.

{Variable}.user.DC Get DCName from Registry ... {Variable}.registry.read Get/Read Registry Entries

AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.

APT41 used the WMIEXEC utility to execute whoami commands on remote machines; FIN10 used Meterpreter to enumerate users on remote systems; Operation Wocao enumerated sessions and users on a remote host.

The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.

The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.

{Variable}.process.list Enumerates Process

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

{Variable}.file.getPath Get specified file path {Variable}.file.readText Reads specified text file ... {Variable}.file.readBinary Reads specified binary file.

“Discovery Account Discovery (T1087)” ... Koadic spawns child processes ... running a natively supported command such as ‘whoami /groups’.

APT1 listed connected network shares. APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$. APT41 used the net share command as part of network reconnaissance.

During the 2025 Poland Wiper Attacks, adversaries utilized RDP to log into jump hosts and then moved laterally to other victim devices to include a domain controller.

"PsExec ... can be used to execute binaries on remote systems using a temporary Windows service"; "RemoteCMD can execute commands remotely by creating a new service on the remote system"; "Winexe installs a service on the remote system, executes the command, then uninstalls the service"

“Collection/exfiltration Data from Local System (T1005)” ... “Koadic redirects STDOUT/STDERR to a temporary text file that stores the output of the operator’s commands.”

Agent Tesla can steal data from the victim’s clipboard. APT38 used a Trojan called KEYLIME to collect data from the clipboard. APT39 has used tools capable of stealing contents of the clipboard.

Some of the common protocols used for C2 are HTTP/S, DNS, SSH, and SMTP, as well as common cloud services like Google, Twitter, Dropbox, etc. Using common protocols and services for C2 allows adversaries to masquerade as normal network traffic and hence evade firewalls.

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

...на устройство жертвы загружается малварь, а атакующие получают удаленный доступ к системе.

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").