Group IB APT 41 June 2021

APT41 has used hashdump, Mimikatz, Procdump, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.

APT41 has uploaded files and data from a compromised host.

APT41 collected MAC addresses from victim machines.

APT41 has created services to appear as benign system tools.

APT41 attempted to masquerade their files as popular anti-virus software.

APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit. APT41 has executed files through Windows Management Instrumentation (WMI).

APT41 has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.

APT41 used DNS for C2 communications.

APT41 used certutil to download additional files. APT41 downloaded post-exploitation tools such as Cobalt Strike via command shell following initial access. APT41 has uploaded Procdump and NATBypass to a staging directory and has used these tools in follow-on activities.

APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

APT41 used the net share command as part of network reconnaissance.

APT41 modified legitimate Windows services to install malware backdoors. APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.

APT41 created and modified startup files for persistence. APT41 added a registry key in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost to establish persistence for Cobalt Strike.

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.

APT41 used svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.