Since the middle of July, McAfee has observed new updates of the Emotet, a Trojan that was first discovered in 2014. This malware harvests banking credentials. Early variants used Outlook contact harvesting to spread via malicious spam.
The latest variants act as loaders and use several mechanisms to spread over the network and send spam email. They also use techniques to bypass antimalware products and avoid detection. Initial infection vectors are emails containing a link to download a malicious Office document. Once a system is infected, Emotet collects the computer name and running process information, which are encrypted and sent to a control server via a Post request.
Emotet updates itself with the latest version from the server, and attempts to download additional malware, such as Dridex (banking malware). The banking malware is designed to harvest banking credentials by installing a malicious component into the web browser. It also uses evasion techniques such as “atom bombing” to inject malicious code.
The following illustration shows how Emotet works:
Analysis
The initial infection vector of Emotet is a malicious Office document containing an obfuscated macro that runs a PowerShell script to download the payload.
Additional information can be found here:
- https://isc.sans.edu/diary/rss/22658
- https://isc.sans.edu/forums/diary/Malspam+pushing+Emotet+malware/22650/
Details of our analyzed sample.
The malware uses several mechanisms to stay persistent and undetected. It unpacks itself directly into memory and drops malicious files in the system. Emotet acts as a loader and can enable several modules. During our analysis, we saw the following:
- Worm module via brute-force attack to spread over the network.
- Dropping malware.
- Sending spam with compromised emails to spread around the world.
- Updating main file to bypass antimalware signatures.
These modules are enabled by the control server and allow the attackers to perform malicious actions on infected machines.
The malware contains an icon that can be identified on infected machines. We saw several updates to the icon during the campaign:
Emotet malware icons.
Once the malware is running, it is unpacked several times into memory. This process allows the malware to bypass antimalware detection before runtime. The following screenshot shows the unpacking process.
Unpacking at runtime.
The malware changes its name to avoid detection once it has infected a system. In this case the malware used certtask.exe. Each infected machine could have a different name.
Emotet uses several mechanisms to stay persistent, allowing it to run after each reboot. It also creates a service to run the malicious file. Early variants created scheduled tasks.
Run key.
Emotet employs a control server to communicate with infected machines and send the stolen credentials:
Control server connection.
The malware updates itself by sending a Post request and showing a 404 error from the server to fool analysts.
A Post request.
The control server address changed throughout the campaign.
Worm module
We found that Emotet uses a worm module to spread on the network. It brute-force attacks an account to break the password and copy itself on a network share.
A brute-force attack. The malware attempts to connect to specific users.
Spam module
Emotet spreads by email from compromised accounts. The attackers can remotely activate the spam module, which dynamically uses the credentials to send email:
Spam module.
Evasion tricks
The sample arrives packed and runs several processes to unpack its content. By tracking the VirtualAlloc API, we can follow the dump of an unpacked version into memory.
Dumping the unpacked executable into memory.
The dumped executable is a file that runs without an import address table to avoid static analysis. All the functions are resolved dynamically when the sample runs.
Dynamic API resolution.
The sample creates a mutex as an infection marker to detect if the machine is already infected.
Creating a mutex to match the filename emo.bin.
The malware uses a different mutex, generated with the filename during execution, to avoid any possible vaccine. The mutex is always the same if the filename does not change.
The following example shows a different mutex name with a different filename:
Creating a mutex to match the filename emoo2.exe.
To detect any debugging, Emotet employs the undocumented function NtSetInformationProcess:
Emotet creates a suspended process to unpack. If the debugger is detected, the malware terminates the suspended process; otherwise it continues the execution and infects the system.
Conclusion
Emotet has evolved to take advantage of several evasions, persistence, and spreading techniques. It also downloads additional malware to harvest banking credentials and take other actions.
The spreading techniques on the local network seem to have come from lessons learned from the WannaCry and (Not)Petya outbreaks to increase the rates of infection. We can expect to see more weaponized lateral movements in the future.
The author thanks @tehsyntx and @_remixed for their help with this analysis.
Indicators of Compromise
Persistence
- C:\Windows\System32\<randomnumber>\
- C:\Windows\System32\tasks\<randomname>
- C:\Windows\\<randomname>
- C:\users\<myusers>\appdata\roaming\<random>
- %appdata%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
- <Randomname>.LNK. file in the startup folder
Registry keys
- HKLM\System\CurrentControlSet\Services “RandomNumbers”
- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “RandomNames” with value c:\users\admin\appdata\roaming\<random>\<legitfile>.exe
IP addresses
- 216.81.62.54 Canada
- 87.106.1.205 Germany
- 178.254.40.5 Germany
- 193.23.244.244 Germany
- 217.160.15.198 Germany
- 217.160.178.17 Germany
- 131.188.40.189 Germany
- 80.86.91.232 Germany
- 91.134.140.21 France
- 5.196.73.150 France
- 91.121.121.72 France
- 37.187.103.156 France
- 62.210.206.25 France
- 178.79.132.214 United Kingdom
- 95.110.224.51 Italy
- 188.166.175.18 Netherlands
- 141.138.200.249 Netherlands
- 195.191.233.221 Poland
- 203.150.19.63 Thailand
- 50.21.183.63 United States
- 192.81.128.131 United States
- 173.230.145.224 United States
- 199.21.113.151 United States
- 50.3.75.246 United States
- 23.218.156.113 United States
- 128.31.0.39 United States
- 8.253.164.249 United States
- 192.81.212.79 United States
- 208.83.223.34 United States
- 173.243.126.142 United States
- 207.210.245.164 United States
- 69.43.168.206 United States
- 162.243.159.58
- 192.241.222.53
Hashes
- 752c5a1fb7a0e6681639fa737e73ae6aa3a0f3b7973fe3fd59b4b2014bbcd9c2
- 76f4c1f1fda795e5b0a00be3833787c568cacf5ec6ea3275dc1e6ec2a4e282a0
- cc73d5d14ff263f5a364d53d70a3dbc0a5ccddcfbfc325b4912cf00717c62271
- 8c610977850dae5f3369865ed1583167556e0fa544b2de651c4ac217621d2dea
- 9ccbdf2fb651fd46b4ac4437e71f89ddbfbc94d2018e871ccc534746f74e88eb
- 881c5a483e9766e641437df6b2dfa79960ae353b9a90407b6ebf6ae33498edd8
- 163278f8c95d8fcaa824f5d5903b54f72d1601d0f3b89e1203ebcc5b688d98ed
- 4bae21211ad857bb303f32e278776d6540e9ae478e3bf5b697ae46575e4234d0
- a730e696d2c956041fe914565e1a18e0ca7f6817b5490881236b66167578f5f8
- b4bc52aabe484d4e77589cfce9cc3cb44b2af313545b8d95a130cfd0be6a8681
- 3eab67208efa7a6f6f6b8bb0fd7640c2e981e44a822363974e4c2f17ced35cea
- 95dd3200bdcd9c9c52a0e2a0b72ce16fd36679a1591a743bb22c50f0bb69bd43
- 8cc5ab5f131ea2026d3bf5cafd8bfc0bcd4ce49dc8fed20dcdaa88e6026814b4
- cc73d5d14ff263f5a364d53d70a3dbc0a5ccddcfbfc325b4912cf00717c62271
- 163278f8c95d8fcaa824f5d5903b54f72d1601d0f3b89e1203ebcc5b688d98ed
- a730e696d2c956041fe914565e1a18e0ca7f6817b5490881236b66167578f5f8
- d038914f2aad2a34c7b2ea196a2f528d4f38b8b6cd2954d248a366b231a34989
- aeb990c5c0cd43c39acef20ad7abaaf608f75c06128948e4a322299b88182e86
Stay Updated
Follow us to stay updated on all things McAfee and on top of the latest consumer and mobile security threats.
