Procedure examples

InvisiMole can spread within a network via the BlueKeep (CVE-2019-0708) and EternalBlue (CVE-2017-0144) vulnerabilities in RDP and SMB respectively.

InvisiMole can register itself for execution and persistence via the Control Panel.

InvisiMole has used rundll32.exe for execution.

InvisiMole can use Data Protection API to encrypt its components on the victim’s computer, to evade detection, and to make sure the payload can only be decrypted and loaded on one specific compromised computer.

InvisiMole can can remove all system restore points.

InvisiMole can check for artifacts of VirtualBox, Virtual PC and VMware environment, and terminate itself if they are detected.

InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.

InvisiMole can check for the presence of network sniffers, AV, and BitDefender firewall.

InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.

InvisiMole can place a lnk file in the Startup Folder to achieve persistence.

InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.

InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges.

InvisiMole can use the ITaskService, ITaskDefinition and ITaskSettings COM interfaces to schedule a task.

InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.

InvisiMole can use zlib to compress and decompress data.

InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.

InvisiMole can create hidden system directories.

InvisiMole has executed legitimate tools in hidden windows.

InvisiMole has used Windows services as a way to execute its malicious payload.

InvisiMole uses variations of a simple XOR encryption routine for C&C communications.

InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.

InvisiMole can gather information on the mapped drives and system volume serial number.

InvisiMole has a command to disable routing and the Firewall on the victim’s machine.