Introduction

During 2018, Emotet has been a continual presence in the malicious spam (malspam) landscape.  With few exceptions, malspam from this campaign is active every weekday.  As the months progress, I've generally found follow-up malware from Emotet infections in my lab.  I wrote about one such malware team-up back in July 2018, and Symantec has published an in-depth look at Emotet's evolution from banking Trojan to a delivery service for other threat actors.

In recent weeks, I've generally seen Emotet retrieve Trickbot, the IcedID banking Trojan, or spambot malware for its follow-up infection.  I rarely see Emotet retrieve more than one type of follow-up malware.  But on Tuesday 2018-09-25, my infected lab host retrieved Trickbot and IcedID immediately after an Emotet infection.  Then IcedID caused another infection with AZORult on the same host.

Shown above:  Flow chart for the infection.

Emotet malspam

I currently find three types of Emotet malspam.  The first type has an attached Microsoft Word document with a macro.  The macro is designed to infected a vulnerable Windows host with Emotet.

The second type of Emotet malspam has a link to download the malicious Word document instead of an attachment.

The third type of Emotet malspam has a PDF attachment without any links in the message.  The PDF file contains a link to download the malicious Word document.

All three cases involve a malicious Word document with macros.  In all three cases, opening the Word document and enabling macros will kick off the infection process on a vulnerable Windows host.

Shown above:  Three different types of malspam for Emotet infections.

Shown above:  Example of Emotet malspam with a PDF attachment.

Shown above:  Downloading an Emotet Word document and enabling macros.

Infection traffic

I kicked off an infection with a URL that retrieved an Emotet Word doc.  This could've come from an email link, or it could've come from a PDF attachment.  There's no way tell based on the URL alone.

Shortly after my lab host was infected with Emotet, I saw indictors of a Trickbot infection.  I also saw indicators of an IcedID infection.  Finally, I saw an HTTP request that returned an AZORult malware binary, and it was followed by AZORult post-infection traffic.  See the image below for details.

Shown above:  Traffic from the infection filtered in Wireshark.

The Emotet infection was kept persistent on my infected lab host through the Windows registry.  IcedID and Trickbot were kept persistent through a scheduled task.  After the AZORult executable ran on my infected lab host, it deleted itself, and I didn't find any method of persistence for AZORult.

Shown above:  Emotet persistent on my infected Windows host.

Shown above:  IcedID persistent on my infected Windows host.

Shown above:  Trickbot persistent on my infected Windows host.

Indicators

The following are indicators (IP addresses, domain names, and file hashes) associated with the infection of my Windows lab host.

Traffic from the Emotet infection:

• 5.101.138.188 port 80 - sloegincottage.co.uk - GET /tyoinvur/En_us/Clients/092018/
• 108.167.161.63 port 80 - louisianaplating.com - GET /18Ge0wDF
• 88.208.252.82 port 80 - stonehouse.me.uk - GET /AlvUfSm
• 88.208.252.82 port 80 - stonehouse.me.uk - GET /AlvUfSm/
• 190.147.53.140 port 8090 - 190.147.53.140:8090 - GET /
• 201.111.8.75 port 50000 - Attempted TCP connections, but no response from the server
• 31.167.248.50 port 443 - 31.167.248.50:443 - GET /whoami.php
• 31.167.248.50 port 443 - 31.167.248.50:443 - POST /

Traffic from the Trickbot infection:

• port 80 - icanhazip.com - GET /   (IP address check by the infected host, not inherently malicious)
• 170.81.32.66 port 449 - SSL/TLS traffic caused by Trickbot
• 195.123.210.156 port 447 - SSL/TLS traffic caused by Trickbot
• 138.34.45.133 port 8082 - 138.34.45.133:8082 - POST /arz1/[long string with host info]/90

Traffic from the IcedID infection:

• 93.189.41.44 port 443 - calgama.com - HTTPS/SSL/TLS traffic caused by IcedID
• 185.154.21.160 port 80 - segregory.website - GET /data2.php?B41857926E193158

Traffic associated with the AZORult infection:

• 108.167.137.17 port 80 - www.pruebas.litcel.com - GET /crypt_AU3_EXE.exe   (caused by IcedID)
• 107.182.230.25 port 80 - 107.182.230.25 - POST /index.php

File hashes for malware retrieved from the infected Windows host follow.

SHA256 hash: 34fd8ab80ff403db687517beac2b1d3024f69119e73c054ffe6686b1a0a40489

• File size: 211,584 bytes
• File description: Downloaded Word doc with macro for Emotet

SHA256 hash: d9352b362629bdcd5d7c830a3ea9c5f55d1e0be4240b5df2867903fb317ee7d3

• File size: 219,648 bytes
• File description: Emotet malware executable
• File location: C:\Users\[username]\AppData\Local\Microsoft\Windows\[various file names].exe

SHA256 hash: 806bc3a91b86dbc5c367ecc259136f77482266d9fedca009e4e78f7465058d16

• File size: 519,149 bytes
• File description: Trickbot caused by Emotet infection (gtag: arz1)
• File location: C:\Users\[username]\AppData\AIMT\[string of characters].exe

SHA256 hash: 2cbb833b3410d0d27719614f3b4ffe8f16d7dd5242a8b85f35619405b110784e

• File size: 392,192 bytes
• File description: IcedID caused by Emotet infection
• File location: C:\ProgramData\{12345678-1234-1234-1234-12345689ABC}\[string of characters].exe   --   various hex digits between the { }

SHA256 hash: 80aa7f6f6b25aaf43e52d5ca6971f5dac45b3b2e0ed5c5f3843080b03771c2cc

• File size: 536,576 bytes
• File description: AZORult caused by IcedID infection
• File location: C:\Users\[username]\AppData\Local\[string of characters].exe
• File location: hxxp://www.pruebas.litcel.com/crypt_AU3_EXE.exe

Final words

Most enterprise spam filters are quite good at blocking malspam pushing Emotet.  From what I can tell, online email services like Gmail and Yahoo also seem to keep these messages from your inbox.  But it only takes one message to make it through, and it only takes one person to click their way through any warnings to successfully infect a vulnerable Windows host.

However, properly-administered and up-to-date Windows hosts are not likely to get infected.  Windows warns potential victims if such Word documents are downloaded from the Internet, and recent versions of Microsoft Office have a Protected View feature that should prevent people from accidentally enabling these macros.  Furthermore, system administrators and the technically inclined can implement best practices like Software Restriction Policies (SRP) or AppLocker to prevent these types of infections.

Email examples, pcap, and malware associated with today's diary can be found here.

---
Brad Duncan
brad [at] malware-traffic-analysis.net