AveMariaRAT

This malware, used by the mentioned groups, can infiltrate the infrastructure in various ways, from exploiting Spear-Phishing to compromising websites where it is downloaded.

Fortinet’s FortiGuard Labs captured a phishing campaign that was delivering three fileless malware onto a victim’s device... The captured phishing email... was disguised as a notification of a payment report from a trusted source.

it decodes a command string and executes it using a WMI (Windows Management Instrumentation) object.

It then runs schtasks to create a schedule task named “calendersw” in the system “Task Scheduler“... It is also a persistence mechanism. Once it starts, back.htm adds more scheduled tasks.

It runs the PowerShell application to download a PowerShell file called “mainpw.dll” and then execute it.

It contains an auto-start Macro that starts using a VBA (Visual Basic Application) method called “Auto_Open()” when the Excel file is opened.

The HTML file contains a piece of JavaScript code... It creates an object, “Wscript.Shell”... In Figure 3.1 we can see it runs five command-line applications.

This email attempts to trick the recipient into opening the attached Excel document... The Excel document is named “Remittance-Details-951244.xlam”. It’s an Excel Add-In (*.xlam) file that contains malicious macros.

It then runs schtasks to create a schedule task named “calendersw” in the system “Task Scheduler“... It is also a persistence mechanism. Once it starts, back.htm adds more scheduled tasks.

A common practice I have observed in WarZone RAT is modifying network elements, as well as modifying keys like \CurrentVersion\Internet Settings

After this, it is common for the malware to establish persistence. Depending on the sample, it may create a copy of itself and then add the path to \CurrentVersion\Run (or similar) registry key, or it may leave a copy of itself or a script in a startup folder that will be executed on system startup

It then runs schtasks to create a schedule task named “calendersw” in the system “Task Scheduler“... It is also a persistence mechanism. Once it starts, back.htm adds more scheduled tasks.

Once the sample achieves persistence, the files are launched in the desired folder, and the appropriate privileges are obtained, it commonly proceeds with the injection process.

It then performs process hollowing to inject the malware payload into a newly-created process of “aspnet_compiler.exe”.

After this, it is common for the malware to establish persistence. Depending on the sample, it may create a copy of itself and then add the path to \CurrentVersion\Run (or similar) registry key, or it may leave a copy of itself or a script in a startup folder that will be executed on system startup

A common practice in AveMaria RAT is privilege escalation or bypassing UAC. The most common method involves abusing sdclt.exe

Once the sample achieves persistence, the files are launched in the desired folder, and the appropriate privileges are obtained, it commonly proceeds with the injection process.

It then performs process hollowing to inject the malware payload into a newly-created process of “aspnet_compiler.exe”.

At the end of each malware code segment, the code calls the “Load()” method to load the inner .Net module... then calls the Invoke() method to invoke the “projFUD.PA.Execute()” function... with two parameters, which are an exe file’s full path and a fileless malware payload.

Before that, it copies a local file, “C:\Windows\System32\mshta.exe”, into “C:\ProgramData\” and renames it as “ddond.com”.

The executions vary greatly depending on the version, but typically it tries to determine if it is already running on the machine using a Mutex After that, it can perform anti-dbg/Anti-VM tasks or directly check for security software that may be installed on the system

Commonly, it extracts the code from a specific section and constructs it in memory for subsequent injection. Alternatively, it may assemble or deobfuscate the code from a resource.

During the analysis of different samples, I notice the consistent use of various anti-debugging techniques along with frequent sleep commands that significantly slow down debugging.

A common practice I have observed in WarZone RAT is modifying network elements, as well as modifying keys like \CurrentVersion\Internet Settings

It is common to launch them in a folder like Documents or Downloads and modify the attributes to point to another location, such as ApplicationData or ProgramData.

It also runs taskkill to kill processes, if existing, of MS Word (WinWord.exe), MS Excel (Excel.exe), and MS Pointpoint (POWERPNT.exe).

At this point, the most common action is to gather relevant information about the device and/or the user, such as the operating system type, machine name, language used, etc.

The executions vary greatly depending on the version, but typically it tries to determine if it is already running on the machine using a Mutex After that, it can perform anti-dbg/Anti-VM tasks or directly check for security software that may be installed on the system

At this point, the most common action is to gather relevant information about the device and/or the user, such as the operating system type, machine name, language used, etc.

During the analysis of different samples, I notice the consistent use of various anti-debugging techniques along with frequent sleep commands that significantly slow down debugging.

Typically, the malware will have different addresses to attempt to gain access. It will commonly try to establish a connection by opening a socket to the chosen address.

Once the connection is established, the attacker has achieved the desired objective: a malware injected into a process, whether legitimate or not, from which they can operate.