ATT&CK SoftwareKOPILUWAK

KOPILUWAK

S1075

Malware.View on attack.mitre.org

About this malware

KOPILUWAK is a JavaScript-based reconnaissance tool that has been used for victim profiling and C2 since at least 2017.

Techniques used13

Initial Access1

T1566.001Spearphishing Attachment

Execution2

T1059.007JavaScript T1204.002Malicious File

Discovery6

T1016System Network Configuration Discovery T1033System Owner/User Discovery T1049System Network Connections Discovery T1057Process Discovery T1135Network Share Discovery T1680Local Storage Discovery

Collection2

T1005Data from Local System T1074.001Local Data Staging

Command and Control1

T1071.001Web Protocols

Exfiltration1

T1041Exfiltration Over C2 Channel

Procedure examples13

Technique	Procedure example
T1005 Data from Local System	KOPILUWAK can gather information from compromised hosts. Mandiant Suspected Turla Campaign February 2023
T1016 System Network Configuration Discovery	KOPILUWAK can use Arp to discover a target's network configuration setttings. Mandiant Suspected Turla Campaign February 2023
T1033 System Owner/User Discovery	KOPILUWAK can conduct basic network reconnaissance on the victim machine with `whoami`, to get user details. Mandiant Suspected Turla Campaign February 2023
T1041 Exfiltration Over C2 Channel	KOPILUWAK has exfiltrated collected data to its C2 via POST requests. Mandiant Suspected Turla Campaign February 2023
T1049 System Network Connections Discovery	KOPILUWAK can use netstat, Arp, and Net to discover current TCP connections. Mandiant Suspected Turla Campaign February 2023
T1057 Process Discovery	KOPILUWAK can enumerate current running processes on the targeted machine. Mandiant Suspected Turla Campaign February 2023
T1059.007 JavaScript	KOPILUWAK had used Javascript to perform its core functions. Mandiant Suspected Turla Campaign February 2023
T1071.001 Web Protocols	KOPILUWAK has used HTTP POST requests to send data to C2. Mandiant Suspected Turla Campaign February 2023
T1074.001 Local Data Staging	KOPILUWAK has piped the results from executed C2 commands to `%TEMP%\result2.dat` on the local machine. Mandiant Suspected Turla Campaign February 2023
T1135 Network Share Discovery	KOPILUWAK can use netstat and Net to discover network shares. Mandiant Suspected Turla Campaign February 2023
T1204.002 Malicious File	KOPILUWAK has gained execution through malicious attachments. Mandiant Suspected Turla Campaign February 2023
T1566.001 Spearphishing Attachment	KOPILUWAK has been delivered to victims as a malicious email attachment. Mandiant Suspected Turla Campaign February 2023
T1680 Local Storage Discovery	KOPILUWAK can discover logical drive information on compromised hosts. Mandiant Suspected Turla Campaign February 2023

Groups that use it1

Campaigns1

References1

Mandiant Suspected Turla Campaign February 2023 Open source
Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.