Threat Library - Ave Maria / Warzone RAT

Ave Maria / Warzone RAT

date: 4/27/2021

delivery: email [Subject: Requirement, Attachment: Zip (Requirement.7z) w/ EXE (Sales Order.xlss.exe)

persistence: scheduled task "Updates\xSaltlJa" out of c:\users\<userid>\Roaming\xSZaltlJa.exe

capabilities (per memory strings): N/A

c2s: 104.209.133.4:7500

identification method: in-memory strings say "Ave_Maria"

special notes: in-memory references to security researcher "Vitali Kremez"

samples: 

7z - https://www.virustotal.com/gui/file/86b17ec2dd6ff42243356c4bf06e7b20fb044bba13d74c342c3df706e98484bd/detection

unpacked exe - https://www.virustotal.com/gui/file/e85769eee5f2539084a2da5bf79027849249130be251d1f2e8b3de0021d194ab/detection

links: https://twitter.com/neonprimetime/status/1387139547025260547

screenshots: 

---------------------------------------------------

date: 4/13/2021

delivery: email [Subject: Wholesale Price List, Attachment: XLSB (1-Copy of Quote Industro Sheet 20210413.xlsb, "Digicert logo themed", downloads maskcovld[.]ga/token/rfq/DrawingKit.exe )

persistence: unknown

capabilities (per memory strings): unknown

c2s: crf.eur-import[.]com:6021

identification method: twitter replies

special notes: none

samples: 

File - https://app.any.run/tasks/0cf85641-e5be-4979-9e97-8afc0f30fa67/

Payload - https://tria.ge/210413-mp9t774whx

links: https://twitter.com/neonprimetime/status/1381955462967476228

screenshots: 

    

---------------------------------------------------

Using PE-SIEVE to unpack malware

Just practicing unpacking malware with this sample

http://dreamofareverseengineer.blogspot.com/2017/03/unpacking-malware-in-minutes.html?m=1

md5:dca9106dc8556f9a15d7e18b4fad5d44

What worked was using x64dbg

Attach a breakpoint on CreateProcessInternalW

if I ran a few lines past this I saw a child process spawned (svchost.exe)

And given the context and strings around this call I saw "NtResumeThread" among others

So I set a breakpoint on NtResumeThread (which appears to be ready to launch code in the child process svchost.exe)

Then open a new 2nd instance of x64dbg

"Attach" to svchost.exe , which really isn't doing much right now

Go to the threads tab and you'll see 2 of them!

1 of them is in the "suspended" state

Click into that suspended state and set a breakpoint on the 1st line of code in there

Then click "run" in svchost.exe just to get it so you're not stuck on any breakpoints anymore

Then return to the original x64dbg and click "detach" to allow it to proceed and start the "svchost.exe" process

In the x64dbg on svchost you should now hit it's breakpoint

Now you're inside the 2nd state of the malware but the malicious code hasn't been unpacked so there are still no good strings yet.

Set a breakpoint on VirtualAlloc's ret 10 statement.

Run, then check strings.  If you see nothing, run again, and check strings.

Proceed until you notice the good strings ... (like URLs, etc.)

Then one easy way to get the executable out of memory is to just run 

pe-sieve64.exe /pid ??? 

it will dump the unpacked executable for you

Generic unpacking malware steps

1.) Open malware in IDA

2.) Find the 'ret' of WinMain and look for closes "call" statements above it

3.) Find a VirtualAlloc, follow the EAX result get passed around until you see it in a "call" statement

4.) Find the address of that "call" statement

5.) Flip over to x32dbg, open the same malware, put a breakpoint on the address of the "call"

6.) Also set a breakpoint on VirtualAlloc (bp VirtualAlloc)

7.) Run until breakpoints, Follow in Dump repeatedly on EAX, looking at previous dumps

8.) Find MZ header that does not match original (use Hex Editor to compare)

9.) Follow in memory map, Dump to File, review in PE Studio to see if unpacked

 

FlawedAmmyy unpacking malware example

 FlawedAmmyy unpacking

https://guidedhacking.com/threads/how-to-unpack-flawedammyy-malware-unpacking-tutorial.16637/

7fb83e646cbabc50bec4b33c8130b5ae

https://app.any.run/tasks/97d8c688-a0ed-4602-af79-2409b6d8cd47/

steps

- open ida

- find bottom of "start" (using graph overview window)

- notice all to "WinMain", take it

- find "ret" near bottom of "WinMain" (using graph overview window)

- look just above & around to find any "call" statements, choose "call" closest to the "ret"

- find return of VirtualAlloc

- follow as it's moved from EAX to a "var_**"

- then moved to a register

- then moved to another "var_**"

- until you find a "call var_**" to near the end of the chain

- switch from graph to text view, find the memory address of the "call" statement (0x0040153F)

- open x32dbg

- right-click in CPU tab, "Go To -> Expression", enter that address "0x0040153F"

- cursor should be at same "call" statement as we had in IDA

- set a breakoint in x32dbg on that "call" statement (F2)

- push the play arrow (twice) and run to the breakpoint

- right-click on the "call" statement, choose "Follow in Dump -> Value" (no MX value yet)

- step into the "call" (F7)

- notice code has lots of Stack Strings (API calls like VirtualAlloc, VirtualProtect, etc.)

- when you see "VirtualAlloc", good time to put a breakpoint on all future calls (command: bp VirtualAlloc)

- scroll down until you find either a "call REGISTER", "jmp REGISTER", or "call/jmp DWORD that was a register"

ex: mov dword ptr ss:[ebp-54],eax

call word ptr ss:[ebp-54]

- set a breakpoint (F2) on the registry call

- then run by hitting play arrow

- If "VirtualAlloc" breakpoint is hit, right-click on EAX and "Follow in Dump"

- Keep going until the "Follow in Dump" shows a value at the bottom starting with "MZ" header

- open Hex Editor

- compare original EXE first chars after "MZ" header with what is in "Follow in Dump"

- if same, then hit play arrow again to keep running

- if different, then you may have the unpacked EXE

notes: It may take a while (unpacking can be slow)

When you hit a breakpoint you're looking at the content of "previous" memory regions

- right click "Follow in Memory Map"

- right click "Dump Memory to File"

- how do you know if you did it right?

drop into PE Studio, look at strings, do you see the actual "Ammyy.Service" or "ammy\svn" strings? 

Malware Analysis - Google Docs to DocX to XLSB

 got this email

Link was google drive

Sender: sunringpal33@gmail.com

Subject: A full documents 9674

X-Originating-IP: [209.85.160.196]

Time: 04/09/21 12:43:33

Malware: Phish.LIVE.DTI.URL

URL: hxxps://drive.google[.com/uc?export=download&id=1Z50lnHAW8NKIOL8cvpubm0iaYNHbWqKu

downloaded MD5: fddea65d6393155f25c9fd004e47df83

downloaded Filename: d7653901.docx

which downloads a word doc

Which has another link in it

hxxps://accounting.marayo[.]com/loved.php

Which downloads an Excel doc and redirects to DocuSign

Which the excel doc has macros and looks like this DigiCert fake

Which has a hidden sheet

Which is you change the font color or copy / paste entire contents to notepad++ you'll see the Macro code and a payload url 

hxxps://masterize[.]com[.]br/vendor/laravel/framework/src/Illuminate/Foundation/Console/scmcs.exe

wmic.exe

https://drive.google.com/uc?export=download&id=1Z50lnHAW8NKIOL8cvpubm0iaYNHbWqKu

w

Oracle Database sqlcl basics

 Need to connect to an oracle database?

Download Oracle SQLcl

https://www.oracle.com/tools/downloads/sqlcl-downloads.html

Extract the zip

Login using this command

> SQL username@//server:1521/databasename

Show what user you are

SQL> show user

Now check what version of oracle you're on

SQL>  select BANNER from v$version;

Display the instance you're on

SQL> select INSTANCE_NAME, HOST_NAME, VERSION from v$instance;

Check what database you're connected to

SQL> select name from V$database;

List all user accounts

SQL> select * from all_users;

AppLocker Block vs Sysmon Process Create

 This folder is applocker blocked

  

  

So I copied notepad.exe into it, renamed it, then tried to execute and as you can see applocker blocked me

But Sysmon and Windows both generated an Event ID 1 and 4688