HEXANE

Names and who uses them

• HEXANEOur name
• SpirlinAccenture
• SiamesekittenClearSky
• LyceumSecureworks

Targets

Sectors: Telecommunications, Aerospace

Regions: Middle East, Africa, Israel, Saudi Arabia

Known techniques

• T1010Application Window Discovery
• T1016System Network Configuration Discovery
• T1016.001Internet Connection Discovery
• T1018Remote System Discovery
• T1021.001Remote Desktop Protocol
• T1027.010Command Obfuscation
• T1033System Owner/User Discovery
• T1049System Network Connections Discovery
• T1053.005Scheduled Task
• T1056.001Keylogging
• T1057Process Discovery
• T1059.001PowerShell
• T1059.005Visual Basic
• T1069.001Local Groups
• T1082System Information Discovery
• T1102.002Bidirectional Communication
• T1105Ingress Tool Transfer
• T1110Brute Force
• T1110.003Password Spraying
• T1204.002Malicious File
• T1518Software Discovery
• T1534Internal Spearphishing
• T1546.003Windows Management Instrumentation Event Subscription
• T1555Credentials from Password Stores
• T1555.003Credentials from Web Browsers
• T1567.002Exfiltration to Cloud Storage
• T1583.001Domains
• T1583.002DNS Server
• T1585.001Social Media Accounts
• T1585.002Email Accounts
• T1586.002Email Accounts
• T1588.002Tool
• T1589Gather Victim Identity Information
• T1589.002Email Addresses
• T1591.004Identify Roles
• T1608.001Upload Malware

Malware and tools used