This past week, CB ThreatSight analysts were investigating suspicious events in an environment. This  customer had installed the CB Defense sensor on a subset of systems in monitor only mode for evaluation.  While investigating suspicious events, a CB ThreatSight analyst uncovered a new Emotet campaign that utilized a series of techniques and binaries masquerading as legitimate binaries that ultimately injected an Emotet variant into memory of the compromised system.  

Additional research by the CB Threat Analysis Unit (TAU) discovered at least 225 related samples that were used in two distinct campaigns. The first campaign occurred at the beginning of the year, and the latest campaign began around March 22. This information is being provided to assist researchers and practitioners that may be investigating this campaign.

This campaign highlights the importance of moving away from simple IOC detections and starting to leverage detections based on behavioral anomalies.  

Having visibility into your endpoints is the foundation, that the rest of your security and threat hunting efforts will be built upon. Once this foundation is in place, starting to identify behavioral characteristics that indicate different portions of an attack should be the next phase. Taking this approach is what allowed our analyst to quickly identify the initial phases of this attack, and protected the customer from a breach. Some of the specifics of this investigation showed that attackers are continuing to evolve and use new techniques to avoid detection, this is what they do.  

However focusing on characteristics and behaviors that are suspect regardless of the technique or novelty is what allows you to stay ahead of the curve. This campaign was quickly identified because TAU focuses on creating content and detections that identify these type of suspect behaviors. Having robust amounts of enriched data, allows us to understand at scale what is normal in most environments.  We can then leverage this information to formulate detections around sets of behaviors that are not typically observed under normal conditions. When new campaigns like this are discovered by existing detections in our products, we research them further to determine if we can continue to refine our methods, as well as write campaign specific detections.

The initial step of the campaign involves a phishing document being sent to a target.  Contained in the email is a PDF file that does not contain any malicious code or exploits.  The PDF purports to be a legitimate document, which request that the user follows a hyperlink to a legitimate website.  The actual hyperlink will direct the user to a compromised site, which will download different payloads, dependent upon what is being served at that time of the request.  In the scenario that was being investigated a zip file was downloaded and extracted. The content was a JavaScript file that was then executed. The JavaScript file was obfuscated to avoid detection and hamper analysis.

Ultimately the script would reach out to a set of different C2s which would reply with a binary that was saved to the user’s Temp directory and executed. It should be noted that Word documents were also being served up by the first download site, which resulted in the same outcome.  

This binary was masquerading as a legitimate application, NitroShare.exe in the latest campaign.  This executable contained several layers of unpacking. Ultimately it would decode necessary APIs, which were loaded, and finally it decoded an embedded PE file.  The different sections of this PE file, which is an Emotet variant, were then copied to different sections of the host file’s memory and executed.

Figure 1: Overview of Attack

Technical Details

Initial Detection and Investigation

CB ThreatSight analysts initially investigated an alert generated by the Predictive Security Cloud within the customer’s CB Defense console. Using heuristic analysis the PSC detected several highly suspicious behaviors being performed by applications with unknown reputations.  The image below depicts examples of the behavioral alerts that were generated and triaged. For specific information on Carbon Black product detections, please review the TAU-TIN writeup, which is listed on our User Exchange.

Figure 2:Behavior Alerts

Malicious Attachment

The image below is an example of a PDF document that was sent to targets as part of this campaign.  In this example the PDF is purporting to be from Citibank, and attempts to incite additional actions by informing the reader that their bank account has been suspended.  The hyperlink displays a link to citibank.com, however the actual link will take the compromised system to trinadi[.]my, which is compromised or malicious site. The response from this site was a Zip archive which contained a JavaScript that was then executed.

Figure 3: Phishing Email example

Dropper Analysis

JS File

The image below depicts how the JavaScript looks as is was downloaded from the malicious site.  The additional screenshots that are used in the section below have been altered and variables renamed for analysis.

Figure 4: Attack Overview

The script contains an array which has different strings that are required to provide a decoy error message, as well as download the final stage of this attack.  The area highlighted in blue below shows the string array, while the area in red highlights the decoy error message that is displayed to the user.

Figure 5: Attack Overview

The script will then build the necessary Objects to communicate with the embedded secondary C2s, which are highlighted in the images below in orange.

Figure 6: Attack Overview

The response will then be saved to the user’s Temp file location, as a randomly named .exe (e.g. 0urwf2lu5.exe), highlighted in yellow in the image below.  

Figure 7: Attack Overview

Malicious Dropper

The malicious dropper masquerades as a legitimate file.  The exif data, like copyright, original file name, version number, description, and company are for a legitimate tool.  However none of the code in the binaries is actually related to the executables it is impersonating. The list of file names that this campaign is impersonating is listed in the table below.

 Table 2: Dropper file names used in campaign

Once the malicious dropper is running on the system it only has a limited number of functions. All of these functions are related to injecting additional malicious code into the current process’ memory.  The image below shows the basic start function of the dropper, which will load the necessary libraries and decode the final payload.

Figure 8: Dropper Start function

In order to dynamically load the necessary APIs the dropper will build the strings in memory, which are obfuscated via string stacking and a simple XOR.  The payload itself is obfuscated using a simple series of mathematical operations on each word of the encoded binary, depicted in the image below.

Figure 9: Dropper decoding function

Once the embedded binary is decoded the sections of the binary are copied into different memory sections, which are made RWX.  This makes the code noncontiguous and harder to dump from memory. The memory area where the original decoded binary was located is the released. The Emotet code will then run and in this specific example, copy itself the C:\Windows\syswow64\ directory as startedavg.exe.

Larger Campaign

Research into this larger campaign shows that there were at least two distinct campaigns. In both, they leveraged the same type of dropper, which ultimately would run an Emotet variant on the system.  From the data available to TAU, the first campaign ran for a couple of weeks at the beginning of the year and appeared to mostly be targeting individuals or organizations in the United Kingdom and Germany.  The second campaign began around March 22, and was primarily targeting individuals or organizations in the United States and Canada. In the latest campaign TAU researchers continue to see new variants being used in the wild.  The names in the campaign blocks, are names that the Emotet droppers were using to impersonate legitimate applications.

Figure 10: Campaign Overviews

IOCs

Hashes

Network

Table 3: Network IOCs

MITRE ATT&CK TIDs  

Table 4: Network IOCs

Yara Sig

rule emotet_dropper_2019_Q2_campaign : TAU ecrime Emotet
{
    meta:
        author = "CarbonBlack Threat Research" // jmyers
        date = "2019-Mar-22"
        TID = "T1193, T1204, T1192, T1055, T1140, T1027"
        description = "Emotet Dropper"
        rule_version = 1
        yara_version = "3.7.0"
        exemplar_hashes = "b2e5f1283d28a330cc1712f9cdfdf1077b120b61b53e33debfa96860a6f2c484, a9b41f27b2714035be665a3295f585068fb407c9be9d998cabb7cd3bb16d18d6, 7377d46ffdd35970a386931a17399165e9a0f7c5b872851d742c296d62103ea4"
    
    strings:
        $s1 = "hknj]t34q"
        $s2 = "WdgfR111"
        $s3 = "GetPodu)eHa#dle"
        $s4 = {83 F? 41} //Portion of Decoding Routine
        $s5 = {83 F? 74} //Portion of Decoding Routine
        $s6 = {81 ?? ?? ?? ?? 00 2D 37 00 00}
        $s7 = {81 ?? ?? ?? ?? 00 2C 37 00 00}


   condition:
        6 of ($s*) and
        uint16(0) == 0x5a4d and
        filesize < 500KB  
}

Table 5: Yara Signature