Cybereason Cobalt Kitty 2017

APT32 used GetPassword_x64 to harvest credentials.

APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.

Goopy has the ability to exfiltrate documents from infected systems.

Denis queries the Registry for keys and values.

Denis uses ipconfig to gather the IP address from the system.

APT32 used the ipconfig /all command to gather the IP address from the system.

APT32 has enumerated DC servers using the command net group "Domain Controllers" /domain. The group has also used the ping command.

APT32 used Net to use Windows' hidden network shares to copy their tools to remote machines for execution.

Denis obfuscates its code and encrypts the API names.

Goopy has had null characters padded in its malicious DLL payload.

Denis has encoded its PowerShell commands in Base64.

APT32 has used the `Invoke-Obfuscation` framework to obfuscate their PowerShell.

APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.

Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.

Denis enumerates and collects the username from the victim’s machine.

APT32 collected the victim's username and executed the whoami command on the victim's machine. APT32 executed shellcode to collect the username on the victim's machine.

Goopy has the ability to enumerate the infected system's user name.

APT32 has disguised a Cobalt Strike beacon as a Flash Installer.

Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.

APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe.

Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.

APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.

APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.

APT32 used the netstat -anpo tcp command to display TCP connections on the victim's machine.

Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.

APT32 has used scheduled tasks to persist on victim systems.

APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.

Denis performed process hollowing through the API calls CreateRemoteThread, ResumeThread, and Wow64SetThreadContext.

APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.

Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.

APT32 has used COM scriptlets to download Cobalt Strike beacons.

Denis has a version written in PowerShell.

APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.

Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.

APT32 has used cmd.exe for execution.

Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.

APT32 has used macros, COM scriptlets, and VBS scripts.

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.

APT32 has used JavaScript for drive-by downloads and C2 communications.

Denis has a command to delete files from the victim’s machine.

Goopy has the ability to delete emails used for C2 once the content has been copied.

APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP.

Goopy has the ability to communicate with its C2 over HTTP.

APT32 has used email for C2 via an Office macro.

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.

Denis has used DNS tunneling for C2 communications.

Goopy has the ability to communicate with its C2 over DNS.

Denis collects OS information and the computer name from the victim’s machine.

Denis has several commands to search directories for files.

APT32 enumerated administrative users using the commands net localgroup administrators.