Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Emotet actors utilize malicious attachments in phishing emails for initial access, leveraging social engineering tactics to deceive recipients.
- The malware employs various persistence techniques, predominantly utilizing scheduled tasks and Windows Registry modifications to maintain its foothold.
- Command and Control (C2) communication shows diversification, with SSL/TLS encryption used to obfuscate traffic and evade detection.
Executive Summary
Our investigative team recently analyzed a surge in Emotet activity associated with a sophisticated campaign targeting multiple sectors. Throughout this investigation, we observed the actors leveraging a robust infrastructure to distribute malicious payloads via phishing emails. This analysis illustrates the attack chain, detailing the techniques, tactics, and procedures (TTPs) employed by the threat actor. Additionally, we outline potential detection methods and mitigation strategies to bolster defenses against such incursions.
Initial Access
The initial access vector for the Emotet campaign we examined was primarily conducted through phishing emails containing malicious attachments. Our analysis revealed that these emails often masked their malicious intent under the guise of legitimate communications, such as invoices or document requests. The attachments, typically in the form of .doc or .xls files, included macros designed to execute the payload upon user interaction. Upon enabling macros, the dropper would initiate a series of commands that connected to the actor’s C2 infrastructure.
Execution & Persistence
Upon successful execution, the Emotet malware establishes persistence by creating scheduled tasks. Our investigation identified scheduled tasks located at C:\Windows\System32\Tasks\EmotetTask which executed a PowerShell command to download additional payloads. Additionally, we found modifications to the Windows Registry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run with entries pointing to the Emotet binary, ensuring that it runs at startup. These tactics allow the malware to maintain a presence on the compromised systems covertly.
Command and Control
The C2 communications from the compromised environment were obscured through the use of SSL/TLS encrypted connections to multiple domains registered with various registrar services. During our analysis, we identified the actors frequently rotated the C2 domains, creating a robust and resilient network. The malware would beacon back to these domains at intervals that suggested a mix of timed and event-driven communications, indicating a level of sophistication designed to evade standard detection mechanisms.
Lateral Movement & Discovery
As part of our deeper investigation, we uncovered evidence of lateral movement tactics employed by the actors using Emotet. Techniques such as T1075 – Pass the Hash were observed, allowing them to leverage stolen NTLM hashes to authenticate against other devices within the network. This lateral movement not only facilitated access to additional systems but also increased the overall assurance of ensuring that the malware spread throughout the environment without raising immediate flags for system administrators.
Impact & Objectives
The ultimate objectives of the actors behind this Emotet campaign appeared to be multifaceted. Beyond the initial financial theft and data exfiltration, we observed indications of them preparing the environment for follow-on payloads such as QakBot and Ransomware variants. This behavior underlines the critical nature of immediate threat containment and incident response efforts aimed at both identifying and neutralizing this malware before it escalated into a more significant incident.
MITRE ATT&CK Mapping
- T1566 – Phishing: The delivery method utilized a phishing attack with malicious attachments to gain initial access.
- T1059.001 – PowerShell: The malware executed PowerShell commands for the purposes of downloading and executing additional payloads.
- T1075 – Pass the Hash: Allowed the threat actors to authenticate to additional systems using stolen credentials.
Detection Opportunities
- Monitor email traffic for unusual patterns and attachments associated with known malicious hashes.
- Implement strict execution controls on macros in documents to prevent malicios executions of VBScripts and PowerShell commands.
- Deploy network monitoring solutions to analyze outgoing SSL/TLS connections to detect anomalous beaconing behavior.
Analyst Notes
This campaign serves as a stark reminder of the ongoing threats posed by advanced persistent threat (APT) actors leveraging established malware families like Emotet. Our findings highlight the need for organizations to maintain proactive security postures, including advanced email filtering, network segmentation to limit lateral movement, and ensuring robust endpoint detections to identify and mitigate threats early. Continuous threat intelligence sharing and monitoring can significantly enhance the resilience of organizations against such sophisticated attacks.
Source: Original Report