Daniel Osei — SOC Lead & Malware Analyst
Key Takeaways
- Emotet has evolved to facilitate diverse payload deployments alongside its traditional operations.
- Initial access is achieved via phishing emails containing malicious attachments, often scripted macros.
- Indicators of compromise (IOCs) in network traffic and file activity can be used to detect the persistence mechanisms employed by the malware.
Executive Summary
During our investigation into a recent series of incidents involving widespread disruption associated with malicious activity targeting financial institutions, we discovered that the actor leveraged Emotet as a primary delivery mechanism for further exploitation. Our analysis revealed that Emotet served not merely as a delivery vector but as a multi-faceted tool enabling the deployment of additional malware, including Ryuk ransomware. The incident demonstrated a complex attack chain that showcases the evolving nature of malware and the intricacies in detecting and responding to such threats.
Initial Access
The attack commenced with the distribution of phishing emails to selected organizations, which appeared to be legitimate invoices. These emails contained attachments in the form of Word documents that were embedded with macros designed to execute a PowerShell script upon user interaction. The macros were obfuscated to bypass initial detection mechanisms, reflecting a sophisticated understanding of common security defenses. By enabling the macros, users inadvertently triggered the download of Emotet modules from the C2 infrastructure controlled by the adversary. This method aligns closely with the Phishing technique recorded in the MITRE ATT&CK framework as T1566.
Execution & Persistence
Upon successful execution, the sample we examined installed Emotet in memory and utilized the C: file path for additional persistence configurations. Our analysis revealed that the malware created multiple registry keys under
ogramData emp emp.datHKEY_CURRENT_USER\Software\[Malware Name] to ensure execution at startup. Moreover, it launched various threads that conducted lateral movements promptly. This behavior is consistent with persistence techniques outlined in T1547.001 as it engaged unused services to maintain long-term access to the compromised environment.
Command and Control
The command and control (C2) infrastructure utilized by the actor showcased a blend of traditional and evasive techniques. Traffic analysis indicated that Emotet communicated with several hardcoded domains and utilized DNS tunneling for data exfiltration. The C2 server addresses were frequently changed to evade detection and analysis. For example, the observed domains included malicious-domain1.com and malicious-domain2.com, leveraging both HTTPS for encrypted communication and non-standard ports to bypass firewall policies. This evasion technique invoked T1071.001 and T1043 in the MITRE ATT&CK framework, respectively.
Lateral Movement & Discovery
Our investigation revealed that once initial access through Emotet was established, the implant began to enable lateral movement. The actor leveraged Windows Management Instrumentation (WMI) to query and manipulate various systems in the network environment. The use of Credential Dumping techniques, specifically via T1003, allowed the actor to harvest user credentials stored on the system and move through the network laterally. We observed targeted Kerberos tickets capable of impersonating legitimate users. Additionally, exploitation of misconfigured services allowed for easier access points without alerting security systems.
Impact & Objectives
As the attack chain progressed, the actor ultimately aimed to deploy Ryuk ransomware, which served as the final payload to execute the intended objectives of financial exploitation and data encryption. The encrypted data rendered victims inoperable, leading to significant operational disruption and the demand for ransom. The analysis of the final stage revealed that the actor used known tactics such as T1486 (Data Encrypted for Impact) to ensure maximum disruption. Additionally, they sought to maintain a foothold within the environment to facilitate future operations, emphasizing the continual evolution of their strategy toward resilience against incident response efforts.
MITRE ATT&CK Mapping
- T1566 – Phishing: Attackers use phishing emails to obtain initial access.
- T1547.001 – Registry Run Keys / Startup Folder: Used to maintain persistence by writing to registry keys.
- T1071.001 – Application Layer Protocol: Web Protocols: Emotet employs HTTP/S for C2 communication.
- T1003 – Credential Dumping: Techniques used for harvesting credentials.
- T1486 – Data Encrypted for Impact: The final deployment of ransomware to encrypt user data.
Detection Opportunities
- Monitor for unusual network traffic patterns corresponding to known Emotet C2 domains.
- Employ email filtering solutions to detect and quarantine emails containing characteristic patterns of malicious attachments typically used by Emotet.
- Implement endpoint detection and response (EDR) solutions capable of identifying registry changes related to persistence mechanisms associated with malware installations.
Analyst Notes
This investigation underscores the recurring threat posed by Emotet and emphasizes the need for comprehensive email security, regular training for end-users, and robust layering of endpoint protections. Continuous monitoring and user reporting processes can provide vital insight into potential breaches while mitigating the risk of successful phishing exploits. Our findings support ongoing efforts to develop proactive strategies against evolving threats using malware like Emotet as a chronic facilitator.
Source: Original Report