Lotus Blossom Jun 2015

Elise executes net start after initial communication is made to the remote server.

Elise executes ipconfig /all after initial communication is made to the remote server.

Elise encrypts several of its files, including configuration files.

If installing itself as a service fails, Elise instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.

Elise injects DLL files into iexplore.exe.

Elise performs timestomping of a CAB file it creates.

Elise communicates over HTTP or HTTPS for C2.

Elise executes systeminfo after initial communication is made to the remote server.

A variant of Elise executes dir C:\progra~1 when initially run.

Elise executes net user after initial communication is made to the remote server.

Elise exfiltrates data using cookie values that are Base64-encoded.

After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.

Elise configures itself as a service.

If establishing persistence by installation as a new service fails, one variant of Elise establishes persistence for the created .exe file by setting the following Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe. Other variants have set the following Registry keys for persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : [self] and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAStorD.

Elise encrypts exfiltrated data with RC4.