Procedure examples

SPAWNCHIMERA has leveraged IPC using a UNIX domain socket between the dsmdm process and the web process.

PITSTOP can listen over the Unix domain socket located at `/data/runtime/cockpit/wd.fd`.

LunarWeb can retrieve output from arbitrary processes and shell commands via a pipe.

Mini Shai-Hulud has executed via the use of `subprocess.run` and fed input through standard input `stdin` which acted as a pipe to send data from the parent process and the child process `sys.executable` within memory.

TrickBot used COM to setup scheduled task for persistence.

Bumblebee can use a COM object to execute queries to gather system information.

Ursnif droppers have used COM objects to execute the malware's full executable payload.

STATICPLUGIN has utilized Windows COM Installer Object to download an MSI package containing files masqueraded as a BMP file.

InvisiMole can use the ITaskService, ITaskDefinition and ITaskSettings COM interfaces to schedule a task.

CLAIMLOADER has leveraged Component Object Model (COM) objects to create a scheduled task using `ITaskService` interface.

Neoichor can use the Internet Explorer (IE) COM interface to connect and receive commands from C2.

Raspberry Robin creates an elevated COM object for CMLuaUtil and uses this to set a registry value that points to the malicious LNK file during execution.

RustyWater has used a WScript.Shell COM object to execute the CertificationKit.ini file.

DarkTortilla has used the `WshShortcut` COM object to create a .lnk shortcut file in the Windows startup folder.

Latrodectus can use the Windows Component Object Model (COM) to set scheduled tasks.

Milan can use a COM component to generate scheduled tasks.

Ramsay can use the Windows COM API to schedule tasks and maintain persistence.

FunnyDream can use com objects identified with `CLSID_ShellLink`(`IShellLink` and `IPersistFile`) and `WScript.Shell`(`RegWrite` method) to enable persistence mechanisms.

POWERSTATS can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.

Gelsemium can use the `IARPUinstallerStringLauncher` COM interface are part of its UAC bypass process.

HermeticWizard can execute files on remote machines using DCOM.

SILENTTRINITY can insert malicious shellcode into Excel.exe using a `Microsoft.Office.Interop` object.

HAWKBALL has used an OLE object that uses Equation Editor to drop the embedded shellcode.

GravityRAT has been delivered via Word documents using DDE for execution.

KeyBoy uses the Dynamic Data Exchange (DDE) protocol to download remote payloads.

RTM can search for specific strings within browser tabs using a Dynamic Data Exchange mechanism.

Valak can execute tasks via OLE.

Ramsay has been delivered using OLE objects in malicious documents.

PoetRAT was delivered with documents using DDE to execute malicious code.

POWERSTATS can use DDE to execute additional payloads on compromised hosts.

Bumblebee can compress data stolen from the Registry and volume shadow copies prior to exfiltration.

Exaramel for Windows automatically encrypts files before sending them to the C2 server.

JumbledPath can compress and encrypt exfiltrated packet captures from targeted devices.

Backdoor.Oldrea writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.

Lurid can compress data before sending it.

AppleSeed has compressed collected data before exfiltration.

NETWIRE has the ability to compress archived screenshots.

Aria-body has used ZIP to compress data gathered on a compromised host.

Machete stores zipped files with profile data from installed web browsers.

PowerLess can encrypt browser database files prior to exfiltration.

After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.

LoFiSe can collect files into password-protected ZIP-archives for exfiltration.

VERMIN encrypts the collected files using 3-DES.

Chrommme can encrypt and store on disk collected data before exfiltration.

RunningRAT contains code to compress files.

Epic encrypts collected data using a public key framework before sending it over the C2 channel. Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server.

LightNeuron contains a function to encrypt and store emails that it collects.

MuddyViper has archived collected web browser data into a file named CacheDump.zip.

TAINTEDSCRIBE has used FileReadZipSend to compress a file and send to C2.

LP-Notes has encrypted collected credentials using AES-CBC from the CNG API and the key ED15C8344B45DAED1E0578F8BC1A32411812C61F4CB45D89B107287DE0E09FFC
and the initialization vector 91A4E6F6D51DAEE773A8F00279792578.