Microsoft NICKEL December 2021

Ke3chang has dumped credentials, including by using Mimikatz.

Ke3chang has used NTDSDump and other password dumping tools to gather credentials.

Neoichor can upload files from a victim's machine.

Ke3chang gathered information and files from local directories for exfiltration.

Neoichor can gather the IP address from an infected host.

Ke3chang has performed local network configuration discovery using ipconfig.

Neoichor can check for Internet connectivity by contacting bing[.]com with the request format `bing[.]com?id=<GetTickCount>`.

Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.

Ke3chang has used Base64-encoded shellcode strings.

Neoichor can collect the user name from a victim's machine.

Ke3chang has used implants capable of collecting the signed-in username.

Ke3chang has dropped their malware into legitimate installed software paths including: `C:\ProgramFiles\Realtek\Audio\HDA\AERTSr.exe`, `C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitRdr64.exe`, `C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\airappinstall.exe`, and `C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd64.exe`.

Ke3chang has used keyloggers.

Neoichor can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` value to 1 in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy` Registry key.

Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.

Neoichor can use HTTP for C2 communications.

Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.

Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.

Neoichor can collect the OS version and computer name from a compromised host.

Ke3chang performs operating system information discovery using systeminfo and has used implants to identify the system language and computer name.

Ke3chang uses command-line interaction to search files and directories.

Ke3chang has used tools to download files to compromised machines.

Neoichor can download additional files onto a compromised host.

Neoichor has the ability to configure browser settings by modifying Registry entries under `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer`.

Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.

Ke3chang has performed frequent and scheduled data collection from victim networks.

Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.

Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.

Ke3chang has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.

Neoichor can use the Internet Explorer (IE) COM interface to connect and receive commands from C2.

Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.

Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.

Ke3chang has used implants to collect the system language ID of a compromised machine.

Neoichor can identify the system language on a compromised host.