Procedure examples

APT38 has collected data from a compromised host.

APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.

APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.

APT38 has renamed system utilities, such as `rundll32.exe` and `mshta.exe`, to avoid detection.

APT38 has put several spaces before a file extension to avoid detection and suspicion.

APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.

APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence. Additionally, APT38 has used living-off-the-land scripts to execute a malicious script via a scheduled task.

APT38 has injected malicious payloads into the `explorer.exe` process.

APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.

APT38 leveraged Sysmon to understand the processes, services in the organization.

APT38 has used PowerShell to execute commands and other operational tasks.

APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine. Additionally, APT38 has used batch scripts.

APT38 has used VBScript to execute commands and other operational tasks.

APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.

APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.

APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.

APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.

APT38 have enumerated files and directories, or searched in specific locations within a compromised host.

APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine. Additionally, APT38 has downloaded other payloads onto a victim’s machine.

APT38 has used the Windows API to execute code within a victim's system.

APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.

APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.

APT38 used a Trojan called KEYLIME to collect data from the clipboard.

APT38 has enumerated network shares on a compromised host.

APT38 has used the RC4 algorithm to decrypt configuration data.

APT38 has conducted watering holes schemes to gain initial access to victims.

APT38 has used links to execute a malicious Visual Basic script.

APT38 has attempted to lure victims into enabling malicious macros within email attachments. Additionally, APT38 has used malicious Word documents and shortcut files.

APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.

APT38 has used CHM files to move concealed payloads.

APT38 has used a renamed version of `mshta.exe` to execute malicious HTML files.

APT38 has used `msiexec.exe` to execute malicious files.

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.

APT38 has created a mutex to avoid duplicate execution.

APT38 has used a custom secure delete function to make deleted files unrecoverable.

APT38 has used Hermes ransomware to encrypt files with AES256.

APT38 has used web shells for persistence or to ensure redundant access.

APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.

APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.

APT38 has installed a new Windows service to establish persistence.

APT38 has used the legitimate application `ieinstal.exe` to bypass UAC.

APT38 has used ISO and VHD files to deploy malware and to bypass Mark-of-the-Web (MOTW) security measures.

APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.

APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.

APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.

APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.

APT38 has conducted spearphishing campaigns using malicious email attachments.

APT38 has created new services or modified existing ones to run executables, commands, or scripts.

APT38 has created fake domains to imitate legitimate venture capital or bank domains.