Procedure examples

Ke3chang has dumped credentials, including by using Mimikatz.

Ke3chang has dumped credentials, including by using gsecdump.

Ke3chang has used NTDSDump and other password dumping tools to gather credentials.

Ke3chang has dumped credentials, including by using gsecdump.

Ke3chang gathered information and files from local directories for exfiltration.

Ke3chang performs service discovery using net start commands.

Ke3chang has performed local network configuration discovery using ipconfig.

Ke3chang has used network scanning and enumeration tools, including Ping.

Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.

Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.

Ke3chang has used Base64-encoded shellcode strings.

Ke3chang has used implants capable of collecting the signed-in username.

Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.

Ke3chang has dropped their malware into legitimate installed software paths including: `C:\ProgramFiles\Realtek\Audio\HDA\AERTSr.exe`, `C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitRdr64.exe`, `C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\airappinstall.exe`, and `C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd64.exe`.

Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.

Ke3chang performs local network connection discovery using netstat.

Ke3chang has used keyloggers.

Ke3chang performs process discovery using tasklist commands.

Malware used by Ke3chang can run commands on the command-line interface.

Ke3chang has used batch scripts in its malware to install persistence mechanisms.

Ke3chang performs discovery of permission groups net group /domain.

Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.

Ke3chang malware RoyalDNS has used DNS for C2.

Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.

Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.

Ke3chang performs operating system information discovery using systeminfo and has used implants to identify the system language and computer name.

Ke3chang uses command-line interaction to search files and directories.

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.

Ke3chang has used tools to download files to compromised machines.

Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.

Ke3chang has performed frequent and scheduled data collection from victim networks.

Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.

Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.

Ke3chang has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.

Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.

Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.

Several Ke3chang backdoors achieved persistence by adding a Run key.

Ke3chang has used Mimikatz to generate Kerberos golden tickets.

The Ke3chang group has been known to compress data before exfiltration.

Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.

Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.

Ke3chang has utilized an ORB (operational relay box) network for reconnaissance and vulnerability exploitation.

Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.

Ke3chang has obtained and used tools such as Mimikatz.

Ke3chang has used implants to collect the system language ID of a compromised machine.