ESET Gelsemium June 2021

Gelsemium can collect data from a compromised host.

Chrommme can collect data from a local system.

Gelsemium can use multiple domains and protocols in C2.

Gelsemium can open random files and Registry keys to obscure malware behavior from sandbox analysis.

Chrommme can enumerate the IP address of a compromised host.

Gelsemium can store its components in the Registry.

Chrommme can encrypt sections of its code to evade detection.

Gelsemium has the ability to compress its components.

Gelsemium can use junk code to hide functions and evade detection.

Chrommme can set itself to sleep before requesting a new command from C2.

Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host.

Chrommme can retrieve the username from a targeted system.

Gelsemium has used unverified signatures on malicious DLLs.

Gelsemium has named malicious binaries `serv.exe`, `winprint.dll`, and `chrome_elf.dll` and has set its persistence in the Registry with the key value Chrome Update to appear legitimate.

Chrommme can exfiltrate collected data via C2.

Gelsemium has the ability to inject DLLs into specific processes.

Gelsemium can enumerate running processes.

Gelsemium can use a batch script to delete itself.

Gelsemium can delete its dropper component from the targeted system.

Gelsemium has the ability to perform timestomping of files on targeted systems.

Gelsemium can use HTTP/S in C2 communications.

Gelsemium has the ability to use DNS in communication with C2.

Chrommme can store captured system information locally prior to exfiltration.

Chrommme has the ability to obtain the computer name of a compromised host.

Gelsemium can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture.

Gelsemium can retrieve data from specific Windows directories, as well as open random files as part of Virtualization/Sandbox Evasion.

Gelsemium has the ability to use TCP and UDP in C2 communications.

Gelsemium can download additional plug-ins to a compromised host.

Chrommme can download its code from C2.

Chrommme can use Windows API including `WinExec` for execution.

Gelsemium has the ability to use various Windows API functions to perform tasks.

Gelsemium can modify the Registry to store its components.

Chrommme has the ability to capture screenshots.

Gelsemium can use token manipulation to bypass UAC on Windows7 systems.

Gelsemium can decompress and decrypt DLLs and shellcode.

Chrommme can decrypt its encrypted internal code.

Gelsemium can use junk code to generate random activity to obscure malware behavior.

Gelsemium can check for the presence of specific security products.

Gelsemium can drop itself in `C:\Windows\System32\spool\prtprocs\x64\winprint.dll` as an alternative Print Processor to be loaded automatically when the spoolsv Windows service starts.

Gelsemium can set persistence with a Registry run key.

Gelsemium can drop itself in C:\Windows\System32\spool\prtprocs\x64\winprint.dll to be loaded automatically by the spoolsv Windows service.

Gelsemium can bypass UAC to elevate process privileges on a compromised host.

Gelsemium can use the `IARPUinstallerStringLauncher` COM interface are part of its UAC bypass process.

Chrommme can encrypt and store on disk collected data before exfiltration.

Gelsemium can use dynamic DNS domain names in C2.

Gelsemium can use custom shellcode to map embedded DLLs into memory.

Chrommme has the ability to list drives.