Secureworks BRONZE BUTLER Oct 2017

BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.

BRONZE BUTLER has exfiltrated files stolen from local systems.

BRONZE BUTLER typically use ping and Net to enumerate systems.

BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.

BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.

BRONZE BUTLER has exfiltrated files stolen from file shares.

BRONZE BUTLER has used at to register a scheduled task to execute malware during lateral movement.

BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.

Daserf can log keystrokes.

BRONZE BUTLER has used PowerShell for execution.

BRONZE BUTLER has used batch scripts and the command-line interface for execution.

Daserf can execute shell commands.

BRONZE BUTLER has used VBS and VBE scripts for execution.

The BRONZE BUTLER uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated.

Daserf uses HTTP for C2.

BRONZE BUTLER malware has used HTTP for C2.

BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.

BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.

BRONZE BUTLER has used net user /domain to identify account information.

BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.

Daserf can download remote files.

BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget).

BRONZE BUTLER has used a tool to capture screenshots.

Daserf can take screenshots.

BRONZE BUTLER has used net time to check the local time on a target system.

Daserf uses custom base64 encoding to obfuscate HTTP traffic.

Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.

BRONZE BUTLER downloads encoded payloads and decodes them on the victim.

BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.

BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.

BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.

BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.

BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.

Daserf uses RC4 encryption to obfuscate HTTP traffic.