Cymmetria Patchwork

Patchwork collected and exfiltrated files from the infected system.

Patchwork attempted to use RDP to move laterally.

Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.

Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor." They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.

A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.

Patchwork used PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.

Patchwork ran a reverse shell with Meterpreter. Patchwork used JavaScript code and .SCT files on victim machines.

Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server.

A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.

Patchwork used Base64 to encode C2 traffic.

Patchwork uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.

Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool).

Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.

Patchwork bypassed User Access Control (UAC).

Patchwork dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data.

Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.

Patchwork enumerated all available drives on the victim's machine.