Cycraft Chimera April 2020

Chimera has gathered the SYSTEM registry and ntds.dit files from target systems. Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via msadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv and used ntdsutil to copy the Active Directory database.

Chimera has used RDP to access targeted systems.

Chimera has used Windows admin shares to move laterally.

Chimera has encoded PowerShell commands.

Chimera has renamed malware to GoogleUpdate.exe and WinRAR to jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe.

Chimera has used WMIC to execute remote commands.

Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st and to maintain persistence.

Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.

Chimera has performed file deletion to evade detection.

Chimera has used a valid account to maintain persistence via scheduled task.

Chimera has has used net user /dom and net user Administrator to enumerate domain accounts including administrator accounts.

Chimera has remotely copied tools and malware onto targeted systems.

Chimera has used direct Windows system calls by leveraging Dumpert.

Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.

Chimera's malware has altered the NTLM authentication program on domain controllers to allow Chimera to login without a valid credential.

Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.

Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.