Mandiant Operation Ke3chang November 2014

Ke3chang has dumped credentials, including by using Mimikatz.

Ke3chang has dumped credentials, including by using gsecdump.

Ke3chang has dumped credentials, including by using gsecdump.

Ke3chang gathered information and files from local directories for exfiltration.

Ke3chang performs service discovery using net start commands.

Ke3chang has performed local network configuration discovery using ipconfig.

Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.

Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.

Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.

Ke3chang performs local network connection discovery using netstat.

Ke3chang performs process discovery using tasklist commands.

Malware used by Ke3chang can run commands on the command-line interface.

Ke3chang performs discovery of permission groups net group /domain.

Ke3chang performs operating system information discovery using systeminfo and has used implants to identify the system language and computer name.

Ke3chang uses command-line interaction to search files and directories.

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.

BS2005 uses Base64 encoding for communication in the message body of an HTTP request.

The Ke3chang group has been known to compress data before exfiltration.

Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.