Return of Emotet: Malware Analysis | Zscaler Blog

Return of Emotet: Malware Analysis | Zscaler Blog

Key Points

Threatlabz has continued its analysis of the return of the prolific Emotet malware. In January 2021, a law enforcement action disrupted the Emotet malware and its infrastructure. This included the arrest of some of the threat actors involved with Emotet. Emotet has returned to the threat landscape as of November 14, 2021 and picked up where it left off after almost a year-long hiatus.

This blog is a follow up to our November 16, 2021 “Return of Emotet malware” post and focuses on the technical aspects of the new version of the Emotet malware.

Anti-Analysis Techniques

To make malware analysis and reverse engineering more difficult, Emotet uses a number of anti-analysis techniques. One of the first ones that stands out is control flow flattening where the structure of the program’s control flow is removed, making it difficult to trace its execution. Figure 1 shows an example function where a randomized “control_flow_state” variable is used along with various while loops, if-else, switch, and other statements to confuse the analysis:

Figure 1: Example function using control flow flattening

Another technique that stands out is Windows API function call hashing with randomized function argument ordering. The Open Analysis HashDB IDA Plugin supports Emotet’s hashing algorithm which helps defeat this anti-analysis mechanism.

Emotet encrypts all its important strings using an XOR-based algorithm and a per-string key. Figure 2 is an example IDA Python function that can be used to decrypt strings:

import struct

def decrypt_str(addr):

    tmp = get_bytes(addr, 8)

    xor_key = struct.unpack(“I”, tmp[0:4])[0]

    enc_len = struct.unpack(“I”, tmp[4:8])[0]

    str_len = xor_key ^ enc_len

    plain_buf = b””

    enc_buf = get_bytes(addr+8, str_len)

    num_dwords = int(str_len / 4)

    for i in range(num_dwords):

        enc_dword = struct.unpack(“I”, enc_buf[i*4:i*4+4])[0]

        plain_dword = xor_key ^ enc_dword

        plain_buf += struct.pack(“I”, plain_dword)

    remaining_bytes = str_len % 4

    if remaining_bytes:

        last_enc_dword = struct.unpack(“I”, enc_buf[-remaining_bytes:] + b”\x00″*(4-remaining_bytes))[0]

        last_plain_dword = xor_key ^ last_enc_dword

        plain_buf += struct.pack(“I”, last_plain_dword)[:remaining_bytes]

    return plain_buf

Figure 2: IDA Python function to decrypt strings

Using the same encryption algorithm as for strings, Emotet stores three encrypted configuration items:

Command and Control

C2 communications is via HTTP requests. An example request looks like Figure 3:

Figure 3: Example C2 request

The URI is randomly generated and data is encrypted in the Cookie header (a POST request is used for larger amounts of data). The Cookie header contains a randomly generated key name and base64 encoded key value. Once decoded, the key value contains:

The AES key used to encrypt request data is generated via the following method:

Plaintext request data, command data, and response data use a basic data encoding to encode DWORDs and variable length data. Request data contains the following:

As an example, a “command poll” (command number 1) contains the following command data:

Response data is encrypted similarly to requests and once decrypted, the data is verified using the embedded ECDSA public key. Once verified, the data contains a command number and optional arguments.

Emotet has three broad commands:

Most of the functionality is implemented in seven subcommands:

Download and execute a DLL with rundll32.exe (Control_RunDLL export)

The core component of Emotet is a downloader used to download and execute additional modules and payloads (e.g. likely Cobalt Strike).

Modules are DLL executables but require data from the Emotet core component and the received C2 command to run:

They use the same set of anti-analysis features as the core component and contain their own list of C2s to send and receive additional data and responses. Analysis of the modules is ongoing, but at the time of research, Threatlabz has observed the following Emotet modules and functionality:

Module ID

Possibly a network proxy module

Most of the observed modules focus on mail and web browser credential theft, stealing emails, and spamming. The stolen mail credentials and emails are most likely used to fuel the spam modules.

Spam Module Analysis

As a deeper dive into one of the modules, let’s look at module ID 29. It is used to send typical spam messages (not reply chain spam). To download data for a spam campaign, the module sends command number “1007” with the following command data to its module specific C2 list:

The C2 responds with encoded data in three lists:

Figure 4: Example of post-processed stolen SMTP account list

Figure 5: Example of post-processed To/From email list

Figure 6: Example of post-processed spam message template

The lists are used to create and execute a spam campaign. In the example above, the attachment was a maldoc with the SHA256 hash of eb8107b9e3162bd5b746d1270433cc26c961331c24fd4c9e90b2bf27902a7bc3.

Reply Chain Spam Module Analysis

The reply chain spam module (module ID 28) works similarly to the module just described. Let’s take a closer look at an example spam campaign generated by this module.

The victim is tricked with a malspam using a reply-chain attack where an email thread has been stolen and pretends to be an original reply of the ongoing conversation (Figure 7):

Figure 7: Stolen mail used in the campaign

The attached malicious document uses social engineering to get the victim to enable macros (Figure 8):

Figure 8: Document with legitimate looking content to trick the user

The malicious macros are obfuscated (Figure 9):

Figure 9: Macro code to deobfuscate HTML code

The deobfuscated macros show that Emotet is downloaded and executed (Figure 10):

Figure 10: Partially deobfuscated HTML code to download and execute the Emotet payload

After a law enforcement disruption and almost a year long hiatus, it seems Emotet is picking up where it left off. The malware’s core functionality is downloading additional modules and payloads. Emotet modules focus on credential theft, email theft, and spamming. Stolen credentials and emails are most likely used with the spamming modules to further the spread of Emotet. Stolen credentials along with Emotet’s secondary payloads (reportedly Cobalt Strike) are most likely used to provide initial access to ransomware operators and affiliates.

Cloud Sandbox Detection

81.0.236[.]93:443

51.68.175[.]8:8080

210.57.217[.]132:8080

Configured C2s

—–BEGIN PUBLIC KEY—–

 

MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQF90tsTY3Aw9HwZ6N9y5+be9Xoov

pqHyD6F5DRTl9THosAoePIs/e5AdJiYxhmV8Gq3Zw1ysSPBghxjZdDxY+Q==

 

—–END PUBLIC KEY—–

 

—–BEGIN PUBLIC KEY—–

 

MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE86M1tQ4uK/Q1Vs0KTCk+fPEQ3cuw

TyCz+gIgzky2DB5Elr60DubJW5q9Tr2dj8/gEFs0TIIEJgLTuqzx+58sdg==

 

—–END PUBLIC KEY—–

This content was originally published here.

Laat een reactie achter

Het e-mailadres wordt niet gepubliceerd.