Last Updated: 2019-10-02 02:37:24 UTC
by Brad Duncan (Version: 1)
Shown below is an example of malicious spam (malspam) pushing Emotet malware. It has an attached Word document with macros designed to install Emotet on a vulnerable Windows host.
Of note, this malspam is based on a message from the inbox of a lab host I infected with Emotet back in March 2019. This information was kept for over 6 months before a host from the Emotet botnet added the additional text and attachment, sending it back to my blog's email address.
I used a sandbox to open the Word document in a vulnerable environment and enable macros. This led to the expected Emotet traffic and artifacts on the infected host.
I expect we'll keep seeing malspam pushing Emotet in the foreseeable future. Of course, properly-administered Windows hosts that follow best security practices are rarely, if ever, vulnerable to these attacks. However, enough vulnerable hosts exist, and apparently enough infections occur to make this activity worthwhile for the criminals.
Sandbox analysis of the Word doc with macros for Emotet can be found here.
brad [at] malware-traffic-analysis.net