NCC Group Chimera January 2021

Chimera has gathered the SYSTEM registry and ntds.dit files from target systems. Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via msadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv and used ntdsutil to copy the Active Directory database.

Chimera has used net start and net use for system service discovery.

Chimera has queried Registry keys using reg query \\<host>\HKU\<SID>\SOFTWARE\Microsoft\Terminal Server Client\Servers and reg query \\<host>\HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Internet Settings.

Chimera has used ipconfig, Ping, and tracert to enumerate the IP address and network environment and settings of the local host.

Chimera has utilized various scans and queries to find domain controllers and remote services in the target environment.

Chimera has used Windows admin shares to move laterally.

Chimera has used WinRM for lateral movement.

Chimera has used the quser command to show currently logged on users.

Chimera has collected data of interest from network shares.

Chimera has used Cobalt Strike C2 beacons for data exfiltration.

Chimera has used the get -b <start ip> -e <end ip> -p command for network scanning as well as a custom Python tool packed into a Windows executable named Get.exe to scan IP ranges for HTTP.

Chimera has used WMIC to execute remote commands.

Chimera has used netstat -ano | findstr EST to discover network connections.

Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st and to maintain persistence.

Chimera has used tasklist to enumerate processes.

Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.

Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.

Chimera has used net localgroup administrators to identify accounts with local administrative rights.

Chimera has used a Windows version of the Linux touch command to modify the date and time stamp on DLLs.

Chimera has used HTTPS for C2 communications.

Chimera has used Cobalt Strike to encapsulate C2 in DNS traffic.

Chimera has staged stolen data locally on compromised hosts.

Chimera has staged stolen data on designated servers in the target environment.

Chimera has used compromised domain accounts to gain access to the target environment.

Chimera has utilized multiple commands to identify data of interest in file and directory listings.

Chimera has used net user for account discovery.

Chimera has has used net user /dom and net user Administrator to enumerate domain accounts including administrator accounts.

Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts.

Chimera has used credential stuffing against victim's remote services to obtain valid accounts.

Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.

Chimera has harvested data from victim's e-mail including through execution of wmic /node:<ip> process call create "cmd /c copy c:\Users\<username>\<path>\backup.pst c:\windows\temp\backup.pst" copy "i:\<path>\<username>\My Documents\<filename>.pst"
copy.

Chimera has harvested data from remote mailboxes including through execution of \\<hostname>\c$\Users\<username>\AppData\Local\Microsoft\Outlook*.ost.

Chimera has used custom DLLs for continuous retrieval of data from memory.

Chimera has used time /t and net time \\ip/hostname for system time discovery.

Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.

Chimera has used net share and net view to identify network shares of interest.

Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.

Chimera has collected documents from the victim's SharePoint.

Chimera has used type \\<hostname>\c$\Users\<username>\Favorites\Links\Bookmarks bar\Imported From IE\*citrix* for bookmark discovery.

Chimera has nltest /domain_trusts to identify domain trust relationships.

Chimera has dumped password hashes for use in pass the hash authentication attacks.

Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.

Chimera has exfiltrated stolen data to OneDrive accounts.

Chimera has used PsExec to deploy beacons on compromised systems.

Chimera has copied tools between compromised hosts using SMB.

Chimera has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS.

Chimera has used side loading to place malicious DLLs in memory.

Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.

Chimera has collected credentials for the target organization from previous breaches for use in brute force attacks.

Chimera has used `fsutil fsinfo drives`, `systeminfo`, and `vssadmin list shadows` for system information including shadow volumes and drive information.