A recent example of Emotet malspam
Shown below is an example of malicious spam (malspam) pushing Emotet malware. It has an attached Word document with macros designed to install Emotet on a vulnerable Windows host.
Shown above: Emotet malspam from Tuesday 2019-10-01.
Of note, this malspam is based on a message from the inbox of a lab host I infected with Emotet back in March 2019. This information was kept for over 6 months before a host from the Emotet botnet added the additional text and attachment, sending it back to my blog's email address.
Shown above: The attached Word document with macros for Emotet.
I used a sandbox to open the Word document in a vulnerable environment and enable macros. This led to the expected Emotet traffic and artifacts on the infected host.
Shown above: Traffic from the infection filtered in Wireshark.
Shown above: The initial Emotet executable file (657.exe) temporarily saved under the user's profile directory.
Shown above: The Emotet executable where it remained persistent on the infected host.
Final words
I expect we'll keep seeing malspam pushing Emotet in the foreseeable future. Of course, properly-administered Windows hosts that follow best security practices are rarely, if ever, vulnerable to these attacks. However, enough vulnerable hosts exist, and apparently enough infections occur to make this activity worthwhile for the criminals.
Sandbox analysis of the Word doc with macros for Emotet can be found here.
---
Brad Duncan
brad [at] malware-traffic-analysis.net
Comments
www
Nov 17th 2022
6 months ago
EEW
Nov 17th 2022
6 months ago
qwq
Nov 17th 2022
6 months ago
mashood
Nov 17th 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
6 months ago
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.
<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
isc.sans.edu
Dec 26th 2022
5 months ago
isc.sans.edu
Dec 26th 2022
5 months ago