Procedure examples

Elise executes net start after initial communication is made to the remote server.

Elise executes ipconfig /all after initial communication is made to the remote server.

Elise encrypts several of its files, including configuration files.

If installing itself as a service fails, Elise instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.

Elise injects DLL files into iexplore.exe.

Elise enumerates processes via the tasklist command.

Elise is capable of launching a remote shell on the host to delete itself.

Elise performs timestomping of a CAB file it creates.

Elise communicates over HTTP or HTTPS for C2.

Elise creates a file in AppData\Local\Microsoft\Windows\Explorer and stores all harvested data in that file.

Elise executes systeminfo after initial communication is made to the remote server.

A variant of Elise executes dir C:\progra~1 when initially run.

Elise executes net user after initial communication is made to the remote server.

Elise can download additional files from the C2 server for execution.

Elise exfiltrates data using cookie values that are Base64-encoded.

After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.

Elise configures itself as a service.

If establishing persistence by installation as a new service fails, one variant of Elise establishes persistence for the created .exe file by setting the following Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe. Other variants have set the following Registry keys for persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : [self] and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAStorD.

Elise encrypts exfiltrated data with RC4.