FireEye APT41 Aug 2019

APT41 has used hashdump, Mimikatz, Procdump, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.

APT41 used the Steam community page as a fallback mechanism for C2.

APT41 deployed rootkits on Linux systems.

APT41 collected MAC addresses from victim machines.

APT41 used RDP for lateral movement. APT41 used NATBypass to expose local RDP ports on compromised systems to the Internet.

APT41 has executed whoami commands, including using the WMIEXEC utility to execute this on remote machines.

APT41 attempted to masquerade their files as popular anti-virus software.

ZxShell can launch port scans.

APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.

APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit. APT41 has executed files through Windows Management Instrumentation (WMI).

APT41 has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.

APT41 used a compromised account to create a scheduled task on a system.

APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.

ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.

APT41 used a keylogger called GEARSHIFT on a target system.

APT41 leveraged PowerShell to deploy malware families in victims’ environments.

APT41 used cmd.exe /c to execute commands on remote machines.
APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.

ZxShell can launch a reverse command shell.

APT41 attempted to remove evidence of some of its activity by deleting Bash histories.

APT41 deleted files from the system.

ZxShell can delete files from the system.

APT41 used DNS for C2 communications.

APT41 used compromised credentials to log on to other systems.

ZxShell can set up an HTTP or SOCKS proxy.

APT41 used a tool called CLASSFON to covertly proxy network communications.

APT41 has added user accounts to the User and Admin groups.

APT41 used legitimate websites for C2 through dead drop resolvers (DDR), including GitHub, Pastebin, and Microsoft TechNet.

APT41 performed password brute-force attacks on the local admin account.

APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

ZxShell can capture screenshots.

APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.

APT41 used the net share command as part of network reconnaissance.

APT41 has created user accounts.

APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.

APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.

APT41 used compiled HTML (.chm) files for targeting.

APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user. APT41 also used Microsoft Bitlocker to encrypt workstations and Jetico’s BestCrypt to encrypt servers.

APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.

ZxShell has a feature to perform SYN flood attack on a host.

APT41 deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.

APT41 modified legitimate Windows services to install malware backdoors. APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.

APT41 leveraged sticky keys to establish persistence.

APT41 created and modified startup files for persistence. APT41 added a registry key in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost to establish persistence for Cobalt Strike.

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.

APT41 created a RAR archive of targeted files for exfiltration. Additionally, APT41 used the makecab.exe utility to both download tools, such as NATBypass, to the victim network and to archive a file for exfiltration.

APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.

ShadowPad uses a DGA that is based on the day of the month for C2 servers.

APT41 has used DGAs to change their C2 servers monthly.

APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows. APT41 has also used legitimate executables to perform DLL side-loading of their malware.

APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.