Procedure examples

Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt.

Daggerfly used Reg to dump the Security Account Manager (SAM), System, and Security Windows registry hives from victim machines.

A Threat Group-3390 tool can read and decrypt stored Registry values.

APT41 deployed rootkits on Linux systems.

TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.

UNC3886 has used the publicly available rootkits REPTILE and MEDUSA on targeted VMs.

APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.

Winnti Group used a rootkit to modify typical server functionality.

BlackByte used tools such as Arp to pull system network information and identify connected devices.

SideCopy has identified the IP address of a compromised host.

GALLIUM used ipconfig /all to obtain information about the victim network configuration. The group also ran a modified version of NBTscan to identify available NetBIOS name servers.

A keylogging tool used by APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.

Kimsuky has used `ipconfig/all` and web beacons sent via email to gather network configuration information. Kimsuky has also identified Host IP addresses leveraging the WMI class `Win32_NetworkAdapterConfiguration`.

admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: ipconfig /all >> %temp%\download

Volt Typhoon has executed multiple commands to enumerate network topology and settings including `ipconfig`, `netsh interface firewall show all`, and `netsh interface portproxy show all`.

APT41 collected MAC addresses from victim machines.

Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.

menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.

APT32 used the ipconfig /all command to gather the IP address from the system.

HAFNIUM has collected IP information via IPInfo.

MuddyWater has used malware to collect the victim’s IP address and domain name.

Naikon uses commands such as netsh interface show to discover network interface settings.

TeamTNT has enumerated the host machine’s IP address.

Sidewinder has used malware to collect information on network interfaces, including the MAC address.

Mustang Panda has used ipconfig and arp to determine network configuration information. Mustang Panda has also utilized SharpNBTScan to scan the victim environment.

ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.

Scattered Spider has used network reconnaissance commands for discovery including `ping` and `nltest`.

Moses Staff has collected the domain name of a compromised network.

OilRig has run ipconfig /all on a victim.

Higaisa used ipconfig to gather network configuration information.

Tropic Trooper has used scripts to collect the host's network topology.

Ke3chang has performed local network configuration discovery using ipconfig.

APT1 used the ipconfig /all command to gather network configuration information.

Turla surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, net config, ipconfig /all, and route commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.

Lotus Blossom has used commands such as `ipconfig` and `netstat` to gather network information on compromised hosts.

Stealth Falcon malware gathers the Address Resolution Protocol (ARP) table from the victim.

Chimera has used ipconfig, Ping, and tracert to enumerate the IP address and network environment and settings of the local host.

MirrorFace has used ipconfig for reconnaissance.

Medusa Group has obtained host network details utilizing the command `cmd.exe /c ipconfig /all`.

Darkhotel has collected the IP address and network adapter information from the victim’s machine.

APT42 has used malware, such as GHAMBAR and POWERPOST, to collect network information.

Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.

Earth Lusca used the command ipconfig to obtain information about network configurations.

Wizard Spider has used ipconfig to identify the network configuration of a victim machine. Wizard Spider has also used the PowerShell cmdlet `Get-ADComputer` to collect IP address data from Active Directory.

Moonstone Sleet has gathered information on victim network configuration.

Play has used the information-stealing tool Grixba to enumerate network information.

HEXANE has used Ping and `tracert` for network discovery.

Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.

Threat Group-3390 actors use NBTscan to discover vulnerable systems.