Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Emotet’s evolution continues with enhanced phishing strategies targeting enterprise credentials.
- Usage of delivery mechanisms indicates a shift towards hosting the malware on compromised websites as opposed to typical email attachments.
- Tracking C2 communications reveals a diverse set of protocols used to evade detection and maintain persistence.
Executive Summary
Our investigation into the latest iteration of the Emotet malware revealed a highly organized phishing campaign aimed at large organizations. Initially observed in late September 2023, the threat actors leveraged both social engineering techniques and sophisticated malware deployment methods, enriching their toolset significantly. Throughout our analysis, we mapped the various tactics, techniques, and procedures (TTPs) in line with the MITRE ATT&CK framework, allowing us to highlight key indicators of compromise and potential defensive measures.
Initial Access
The initial vector we identified in this campaign predominantly relied on phishing emails crafted with business context to target unsuspecting users. These emails contained hyperlinks pointing to compromised domains that hosted malicious JavaScript files. Our analysis confirmed that once a user clicked on the link, a download was triggered, leading to the execution of a dropper executable identified as dropper.exe, located at C:\Users\Public\Documents\dropper.exe. This executable was responsible for establishing the foothold of the Emotet payload.
Execution & Persistence
Upon execution, the dropper extracted and executed the main Emotet loader, which employed an array of techniques to avoid detection. Notably, it created several scheduled tasks to ensure persistence across reboots. Specifically, we noted the creation of a task named EmotetUpdate under Task Scheduler\Microsoft\Windows\Emotet\. This task was configured to execute the malware every hour, demonstrating the actor’s intent to maintain a long-term presence within the environment.
Command and Control
A comprehensive analysis of the C2 infrastructure indicated a diverse set of domains and IP addresses used for communication. The C2 servers displayed a mix of HTTPS and WebSocket protocols, complicating detection efforts. During our investigation, we identified several domains such as maliciousdomain1.com and maliciousdomain2.net that were actively responding to infected clients. Communication typically involved the exchange of configuration files, which dictated the behavior of the payload, including additional payload downloads and commands for lateral movement.
Lateral Movement & Discovery
Once Emotet established a foothold within the network, it utilized built-in Windows commands for lateral movement. The sample we examined employed the T1075 – Pass the Hash technique, potentially targeting other machines with existing administrative credentials. The threat actor demonstrated an understanding of the network architecture, often performing reconnaissance using commands like net view and net use to map out the environment and identify high-value targets.
Impact & Objectives
Ultimately, the primary objectives of this campaign appear to be twofold: data exfiltration and infection of additional systems within the network using secondary payloads such as ransomware or banking Trojans. During our monitoring period, we discovered instances where the compromised hosts served as pivots for launching further attacks, highlighting the significant risk posed by Emotet’s infrastructure. The actor’s operations are indicative of a broader trend towards ransomware deployment in conjunction with credential theft, often leveraging the access secured through Emotet.
MITRE ATT&CK Mapping
- T1566 – Phishing: Delivery of malicious payloads via deceptive email communications.
- T1075 – Pass the Hash: Exploitation of credential hashes to gain unauthorized access to additional systems.
- T1203 – Exploitation for Client Execution: Execution of JavaScript payloads via browser vulnerabilities.
Detection Opportunities
- Monitor outbound connections to known malicious domains associated with Emotet C2 infrastructures.
- Implement alerts for suspicious scheduled tasks creation, especially those atypical in naming convention and frequency.
- Employ behavioral analysis tools to detect abnormal user account activities indicative of lateral movement patterns.
Analyst Notes
This investigation highlights the continuing threat posed by Emotet and its capability to evolve with changing TTPs. Organizations must maintain vigilance, ensuring that user education regarding phishing threats is as strong as technical defenses. Continuous monitoring of network traffic and anomalous behavior, paired with established incident response protocols, will be vital in combating these increasingly sophisticated threats.
Source: Original Report