#avemaria_rat_170220

#IOC #OptiData #VR #avemaria #rat #rtf #ole

https://pastebin.com/DCPutqaR

previous_contact:	n/a

FAQ:			https://malpedia.caad.fkie.fraunhofer.de/details/win.ave_maria

attack_vector
--------------
email attach .RAR (RTF) > OLE > WINWORD/PowerShell GET1 > exe > inject > GET2 > C2

email_headers
--------------
n/a

files
--------------
SHA-256		a4463283f5a3ab502255c7fec9bee784ef59c60cfb6403c3e9fa70f2f8907002
File name	PO.rar		[RAR archive data, v9, flags: Archive volume, Commented, Solid, os: OS/2]
File size	21.17 KB (21679 bytes)

SHA-256		c7cb63136bf492c95a8287d68d9c87bf691f61a78d5e5aa3d58330aa4994b14c
File name	PO.rtf		[Rich Text Format data, version 1, unknown character set]
File size	227.91 KB (233378 bytes)

SHA-256		cec74536b20d20fd5c2efa88ed6acd0b1dc30e3468b0210f77d3dc61e13be813
File name	onedrive.exe (War.exe)		[PE32 executable for MS Windows (GUI) Intel 80386 32-bit]
File size	56.00 KB (57344 bytes)

SHA-256		8a1d35e9d6a89dae14913e3a6f5cd1e076265200b6964a6b2c7525609a14e351
File name	WAR000_encrypted_826437F.bin	[data]
File size	101.06 KB (103488 bytes)


activity
**************
PL_SCR		111.90.146.85

C2		79.134.225.103:5216


netwrk
--------------
[http]
111.90.146.85	GET /War.exe HTTP/1.1 	Mozilla/4.0

[ssl]
172.217.16.14	drive.google.com				Client Hello
216.58.215.97	doc-0o-a0-docs.googleusercontent.com		Client Hello

https://drive.google.com/uc?export=download&id=1MH7ScDeCxiVx_HqUd0pCXym7fK2nwhw0

https://doc-0o-a0-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/b20lm8o33hdvcadejmau7msvqvalgj7d/1582110000000/02764085834106481668/*/1MH7ScDeCxiVx_HqUd0pCXym7fK2nwhw0?e=download


comp
--------------
WINWORD.EXE	3124	TCP	localhost	52482	111.90.146.85	80	ESTABLISHED
ieinstal.exe	3284	TCP	localhost	52484	216.58.215.97	443	ESTABLISHED
ieinstal.exe	3284	TCP	localhost	52483	172.217.16.14	443	ESTABLISHED
ieinstal.exe	3284	TCP	localhost	52487	79.134.225.103	5216	SYN_SENT


proc
--------------
"C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" /n /dde
C:\ProgramData\War.exe
C:\Program Files (x86)\internet explorer\ieinstal.exe | C:\Users\operator\Desktop\War.exe


persist
--------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce				17.02.2020 1:08
Startup key	KDEBREVEVA	commensur
c:\users\operator\subfolder1\onedrive.exe					25.04.2008 0:48


drop
--------------
C:\ProgramData\War.exe
C:\ProgramData\hrjytrj.cmd	| data%\War.exe
C:\Users\operator\subfolder1\OneDrive.exe

# # #
RAR
https://www.virustotal.com/gui/file/a4463283f5a3ab502255c7fec9bee784ef59c60cfb6403c3e9fa70f2f8907002/details
RTF
https://www.virustotal.com/gui/file/c7cb63136bf492c95a8287d68d9c87bf691f61a78d5e5aa3d58330aa4994b14c/details
URL
https://www.virustotal.com/gui/url/f67dcc537c121cb573d4367bca2bddb0bcac2d88d4af2d56e60df93758221038/details
EXE
https://www.virustotal.com/gui/file/cec74536b20d20fd5c2efa88ed6acd0b1dc30e3468b0210f77d3dc61e13be813/details
https://analyze.intezer.com/#/analyses/6ed63295-54de-4f53-a496-8aa8f4634a27

data
https://www.virustotal.com/gui/file/8a1d35e9d6a89dae14913e3a6f5cd1e076265200b6964a6b2c7525609a14e351/details

VR