Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The attack was initiated via a targeted phishing campaign using malicious attachments.
- Emotet was employed as the dropper, facilitating the delivery of secondary payloads.
- Multiple techniques from the MITRE ATT&CK framework were utilized, showcasing advanced persistence and lateral movement capabilities.
Executive Summary
In this analysis, we dissect a sophisticated phishing campaign that utilizes Emotet as a dropper to deliver more malicious payloads. Our investigation details the stages of the attack, including initial access, execution, and command and control (C2) activities, illustrating the actor’s intentions and operational methods. From the phishing email’s initial entry into the victim’s mailboxes to the eventual deployment of various payloads, we explore each phase intricately.
Initial Access
Our analysis revealed that the initial access point was a well-crafted phishing email sent to employees within the target organization. The email contained an attachment labelled as a document—specifically, Invoice_2023.pdf.doc. When opened, this document executed a malicious Visual Basic for Applications (VBA) script designed to download the Emotet binary from a remote known malicious domain. The tactic used to deceive users effectively falls under the category of social engineering, and aligns with the Phishing technique, specifically targeting legitimate email accounts to establish trust.
Execution & Persistence
Upon execution, Emotet leveraged Technique T1059.001 – Command and Scripting Interpreter: PowerShell to facilitate its operations. The malware executed a PowerShell command that retrieved additional payloads from the C2 server, typically using obfuscated script to evade detection. Following this, we found that Emotet placed its executable at C:\Users\Public\Microsoft\Update\svchost.exe, thus establishing persistence through the Windows startup folder, ensuring it would execute on system boot.
Command and Control
The C2 communication for the Emotet variant we analyzed followed a structured pattern of encrypted HTTP requests. We observed periodic beaconing to a domain that mimicked a legitimate service, obfuscating the malicious intent from network defenders. The established connection allowed the malware to receive commands and additional payloads, indicating a well-developed operational architecture. Each successful beacon included the infected host’s information, thereby granting the actor detailed visibility into the operational status of their implant.
Lateral Movement & Discovery
After establishing itself on the victim’s machine, the actor initiated lateral movement using T1075 – Pass the Ticket. Using stolen credentials harvested from the infected system, Emotet attempted to propagate to adjacent systems within the local network. Our investigation highlighted instances of Windows administrative tools such as PowerShell and PsExec being executed to facilitate this lateral movement. Additionally, T1018 – Remote System Discovery was employed to map the local environment for further exploitation, utilizing system queries to gather information about active machines.
Impact & Objectives
The objectives of this campaign appeared multifaceted, with initial motives centering on data exfiltration combined with the potential for further payload delivery. The secondary payloads identified during our analysis included variants of ransomware, indicating that the actor was possibly planning for double extortion tactics. The usage of Emotet as a conduit for other malware underscores the critical importance of detecting not just the initial dropper but the subsequent payloads as well, as the impact could range from financial loss to severe disruption of business operations.
MITRE ATT&CK Mapping
- T1566 – Phishing: The initial access vector through phishing emails.
- T1059.001 – Command and Scripting Interpreter: PowerShell: Execution of PowerShell scripts for payload delivery.
- T1075 – Pass the Ticket: Credential theft and lateral movement using Kerberos tickets.
- T1018 – Remote System Discovery: Information gathering on machines within the network.
Detection Opportunities
- Monitor email gateways for attachment types and common phishing keywords.
- Implement endpoint detection and response (EDR) solutions to alert on unusual PowerShell activity.
- Utilize network intrusion detection systems (NIDS) to identify anomalous C2 behaviors.
Analyst Notes
This case reinforces the necessity of comprehensive user education regarding phishing and the importance of multi-factor authentication as a mitigating measure against lateral movement tactics. Detection capabilities should not only focus on known malware signatures but also include heuristic and behavior-based detections to combat evolving threats like Emotet. Continuous monitoring and refining of incident response protocols will be essential in reducing the dwell time of such threats across networks.
Source: Original Report