Daniel Osei — SOC Lead & Malware Analyst
Key Takeaways
- Emotet campaigns utilize malicious documents to lure victims, often employing social engineering tactics.
- Our analysis revealed that the actor employs the T1193 – Spear Phishing Link technique effectively to gain initial access.
- Command and control infrastructure exhibited resilience with multiple domains and IP addresses rotating in use.
Executive Summary
The resurgence of the Emotet malware has been a concern amongst cybersecurity professionals, particularly due to its modular architecture and its reliance on phishing as a primary vector of attack. Our investigation focused on a recent campaign that leveraged weaponized Office documents, thereby alleviating detection and enabling lateral movement across networks. The threats not only demonstrated classic Emotet behaviors but also highlighted the evolving tactics employed by the actor to maintain persistence and exfiltrate data.
Initial Access
During the investigation, we observed that the initial access vector utilized by the threat actor was through well-crafted phishing emails containing malicious PDF or Word documents. The use of T1193 – Spear Phishing Link was prevalent; these emails often resembled critical updates from internal sources, tricking users into clicking deceptive links. When opened, these documents executed macros that downloaded the payload from remote locations. The malicious documents stored in `C:\Users\Public\Documents\Documents.docm` were particularly notable, as they attempted to obfuscate their intentions by employing visual basic scripts to hide their actions.
Execution & Persistence
Our analysis revealed that once the initial payload was executed, the Emotet dropper initiated a series of actions to maintain persistence. The malware created a registry key at `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\`, allowing it to execute upon system boot. This was complemented by the use of Windows Task Scheduler to create scheduled tasks, thereby ensuring persistence across reboots. Additionally, the actor employed T1059.001 – Command and Scripting Interpreter: PowerShell to run further payloads, showcasing their adeptness in leveraging legitimate tools for nefarious purposes.
Command and Control
The command and control (C2) infrastructure employed in this campaign was robust and multifaceted. The malware utilized multiple C2 domains, often changing with each infection cycle to evade detection. For instance, we noted communication with domains such as `example1.com` and `example2.net`, both of which displayed typical characteristics of domain generation algorithms (DGA). The use of T1071.001 – Application Layer Protocol: Web Protocols allowed the implant to communicate over HTTP/S, further enforcing its stealthy approach by blending in with normal web traffic. This behavior is indicative of the actor’s careful planning to minimize the risk of detection by IDS/IPS systems.
Lateral Movement & Discovery
As part of the lateral movement phase, the implant executed T1021.001 – Remote Services: Remote Desktop Protocol to pivot from the initial compromised host to other machines within the network. Our investigation uncovered evidence of attempts to harvest credentials through T1110 – Credential Dumping, utilizing tools such as Mimikatz to extract hashes from memory. Moreover, the presence of SMB-based enumeration via T1087.001 – Account Discovery: Local Account was noted, which allowed for identifying additional targets within the network. This stage emphasized the actor’s objective to establish a foothold in multiple systems, increasing their operational reach.
Impact & Objectives
The main objectives of the Emotet campaign were aligned with data exfiltration and preparation for future ransomware deployments. As we delved into the exfiltration methods used by the malware, it became apparent that the actor was gathering confidential data, potentially for later sale to other threat actors or for use in follow-on attacks. Indicators suggested the final payloads often linked to TrickBot, indicating a concerted effort to deliver ransomware once the environment was deemed suitable. This reconnaissance and data gathering significantly increases the risk to organizations, as it allows attackers detailed insight into potential vulnerabilities.
MITRE ATT&CK Mapping
- T1193 – Spear Phishing Link: The technique used to initiate access through phishing emails containing malicious links.
- T1059.001 – Command and Scripting Interpreter: PowerShell: Provided the actor a means to execute arbitrary commands and scripts.
- T1021.001 – Remote Services: Remote Desktop Protocol: Enabled lateral movement within the network.
- T1110 – Credential Dumping: Allowed the actor to harvest credentials to facilitate further access.
Detection Opportunities
- Implementing strict email filtering protocols to detect and quarantine potential phishing emails containing suspicious links.
- Monitoring registry changes for the creation of auto-start entries that do not conform to organization policies.
- Setting alerts for unusual outbound connections, particularly to known malicious C2 domains.
Analyst Notes
Our investigation into the resurgence of Emotet has highlighted not only its adaptability but also the ongoing risks posed by its use of social engineering techniques and sophisticated command and control methods. Organizations must remain vigilant and proactive in their defenses, particularly with regard to phishing and lateral movement detection, to mitigate the threats posed by this malicious actor.
Source: Original Report