Mandiant ROADSWEEP August 2022

CHIMNEYSWEEP can collect files from compromised hosts.

CHIMNEYSWEEP can use a custom Base64 alphabet to encode an API decryption key.

The CHIMNEYSWEEP installer has been padded with null bytes to inflate its size.

CHIMNEYSWEEP can use `LoadLibrary` and `GetProcAddress` to resolve Windows API function strings at run time.

CHIMNEYSWEEP can extract RC4 encrypted embedded payloads for privilege escalation.

The ROADSWEEP binary contains RC4 encrypted embedded scripts.

CHIMNEYSWEEP has included the victim's computer name and username in C2 messages sent to actor-owned infrastructure.

During HomeLand Justice, threat actors renamed ROADSWEEP to GoXML.exe and ZeroCleare to cl.exe.

CHIMNEYSWEEP can upload collected files to the command-and-control server.

CHIMNEYSWEEP can use the Windows `SilentCleanup` scheduled task to enable payload execution.

CHIMNEYSWEEP has the ability to support keylogging.

CHIMNEYSWEEP can check if a process name contains “creensaver.”

ZeroCleare can receive command line arguments from an operator to corrupt the file system using the RawDisk driver.

CHIMNEYSWEEP can invoke the PowerShell command `[Reflection.Assembly]::LoadFile(\"%s\")\n$i=\"\"\n$r=[%s]::%s(\"%s\",[ref] $i)\necho $r,$i\n` to execute secondary payloads.

ROADSWEEP can open cmd.exe to enable command execution.

CHIMNEYSWEEP has executed a script named cln.vbs on compromised hosts.

ZeroCleare has the ability to uninstall the RawDisk driver and delete the `rwdsk` file on disk.

ROADSWEEP can use embedded scripts to remove itself from the infected host.

CHIMNEYSWEEP can time stomp its executable, previously dating it between 2010 to 2021.

CHIMNEYSWEEP can send `HTTP GET` requests to  C2.

CHIMNEYSWEEP can store captured screenshots to disk including to a covert store named `APPX.%x%x%x%x%x.tmp` where `%x` is a random value.

CHIMNEYSWEEP has the ability to enumerate directories for files that match a set list.

ROADSWEEP can enumerate files on infected devices and avoid encrypting files with .exe, .dll, .sys, .lnk, or . lck extensions.

CHIMNEYSWEEP has the ability to use use Telegram channels to return a list of commands to be executed, to download additional payloads, or to create a reverse shell.

CHIMNEYSWEEP can download additional files from C2.

ZeroCleare can call the `GetSystemDirectoryW` API to locate the system directory.

CHIMNEYSWEEP can use Windows APIs including `LoadLibrary` and `GetProcAddress`.

CHIMNEYSWEEP can use the Windows Registry Environment key to change the `%windir%` variable to point to `c:\Windows` to enable payload execution.

CHIMNEYSWEEP can capture screenshots on targeted systems using a timer and either upload them or store them to disk.

CHIMNEYSWEEP can capture content from the clipboard.

CHIMNEYSWEEP can monitor for removable drives.

ROADSWEEP can identify removable drives attached to the victim's machine.

CHIMNEYSWEEP can use a custom Base64 alphabet for encoding C2.

ROADSWEEP can decrypt embedded scripts prior to execution.

CHIMNEYSWEEP can use an embedded RC4 key to decrypt Windows API function strings.

CHIMNEYSWEEP can use CMSTP.exe to install a malicious Microsoft Connection Manager Profile.

CHIMNEYSWEEP can execute a task which leads to execution if it finds a process name containing “creensaver.”

ROADSWEEP requires four command line arguments to execute correctly, otherwise it will produce a message box and halt execution.

ROADSWEEP can RC4 encrypt content in blocks on targeted systems.

During HomeLand Justice, threat actors used ROADSWEEP ransomware to encrypt files on targeted systems.

ROADSWEEP can disable critical services and processes.

ROADSWEEP has the ability to disable `SystemRestore` and Volume Shadow Copies.

CHIMNEYSWEEP is capable of checking whether a compromised device is running DeepFreeze by Faronics.

CHIMNEYSWEEP can reboot or shutdown the targeted system or logoff the current user.

CHIMNEYSWEEP can make use of the Windows `SilentCleanup` scheduled task to execute its payload with elevated privileges.

CHIMNEYSWEEP has been dropped by a self-extracting archive signed with a valid digital certificate.

ROADSWEEP can pipe command output to a targeted process.

ZeroCleare can corrupt the file system and wipe the system drive on targeted hosts.

ZeroCleare can use the `IOCTL_DISK_GET_DRIVE_GEOMETRY_EX`, `IOCTL_DISK_GET_DRIVE_GEOMETRY`, and `IOCTL_DISK_GET_LENGTH_INFO` system calls to compute disk size.

ROADSWEEP can enumerate logical drives on targeted devices.