|
2017-07-26 update: After publishing this diary, we were contacted by several people who provided samples of the emails. Screenshots of these emails have been added after my signature block. Thanks to everyone who responded! Introduction On Tuesday 2017-07-25, we were contacted by a reader through our contact page. He sent us a Microsoft Word document, and he included the following message: Received a typical phishing email pointing to the site: anduron.com/XXGX911533. This links downloads a doc with an open document macro. Interestingly, the macro was not encrypted. Understanding the payload however is outside my skill set... I examined the Word document and found it's a downloader for Emotet malware. We never obtained a copy of the associated email. Emotet is generally known as a banking Trojan, although it's also been described as a downloader with worm-like propagation. Emotet is commonly distributed through malicious spam (malspam). This diary reviews my investigation of the anduron.com URL and associated Word document we received from the reader on Tuesday 2017-07-25.
The Word document The Word document is a typical macro-based downloader. You enable Word macros after opening the document, and the macro code attempts to download and run malware. Without enabling macros, you can view the malicious macro code from this Word document as shown below.
Enabling macros caused the code to download a Windows executable (an Emotet binary) to the user's AppData\Local\Temp directory with a file name of 5 random digits and an .exe file extension. This file executed and promptly deleted itself from the AppData\Local\Temp directory. Before that, the malware copied itself to the user's AppData\Local\Microsoft\Windows directory as shedulecart.exe, and it updated the Windows registry to make itself persistent after a reboot.
Infection traffic At this point, I didn't know what the malware was, so I reviewed the network traffic. The URL to download the malicious document was still active, so I retrieved the Word document from anduron.com and infected a Windows host. I wasn't familiar with the traffic, but I had monitored the infection with a Security Onion host running Suricata and the EmergingThreats Pro ruleset. Using Sguil to review the events, I saw some hits on Emotet.
Indicators of Compromise (IOCs) Payload Security's reverse.it sandbox analysis (same as hybrid-analysis.com) of the Word document shows 5 other URLs from the macro that download the same Emotet malware binary. Payload Security's analysis also shows a list of 35 different URLs, presumably links from the malspam that download the same malicious Word document.
The following are IOCs associated with malspam pushing Emotet malware on 2017-07-25: Word document from links in the emails:
Emotet binary downloaded by the Word macro:
Links from the malspam to download the word document:
Macros from the Word document downloading the Emotet binary:
HTTP post-infection traffic:
Post-infection attempted TCP connections, but no response (or RST) from the server:
Final words As mentioned earlier, we didn't obtain a copy of the email with a link to the Word document. Last month, a similar report on Emotet was published on malwarebreakdown.com, but it was also without an example of the associated emails. If anyone has an example of these emails, feel free to share a copy through our contact page. If your organization follows best security practices, your risk of infection is minimal. However, we continue to see reports on this type of malspam on a near-daily basis. That implies the criminals behind it are at least somewhat successful. Pcap and malware samples for today's diary can be found here. --- 2017-07-26 update: Anther reader contacted us with additional info on yesterday's Emotet malspam. From the reader: We saw this campaign as well yesterday. The senders were all random, but they seem to rely on the "from" field to lend increased credibility. There were two emotet campaigns with the one before this using other employee names that work in the same department as the recipient. This campaign used a very convincing "bill" from AT&T, with the exception of the odd characters for AT&T in the body everything else seemed pretty convincing. Subjects: AT&T Bill Message
2017-07-26 additional update: Thanks to everyone who emailed contacted us with examples of malspam they found pushing Emotet. See additional screenshots below:
|
Brad 412 Posts ISC Handler Jul 26th 2017 |
| Thread locked Subscribe |
Jul 26th 2017 4 years ago |
|
Great write-up.
Phishing Doc = 6c432ce15af25a465aa322f1effad18624cef77c It randomly grabbed a URL from: http://peerserv.com/kboaggx/ http://daosushiandthai.com/ut/ http://choosesccs.com/lwzmlyxyh/ http://mediac.org/j/ http://perlinskidesign.com/bweyjeli/ 2nd stage payload = 7906179bac706463436b24ef1393d46c5781b768 The 2nd stage called itself mgmtspec.exe when it set up persistence. |
Anonymous |
| Quote |
Jul 26th 2017 4 years ago |
|
Hey all,
Much to my surprise, I came across this forum post on the grounds that my domain appeared in the exploit list. Just wanted to drop a line and note that the danielmerchen.com domain and the corresponding content have been scrubbed. |
Anonymous |
| Quote |
Jul 27th 2017 4 years ago |
|
Thank you for being transparent and fixing your website!
|
Xme 641 Posts ISC Handler |
| Quote |
Jul 27th 2017 4 years ago |
|
Hi Guy,
Not sure if links are allowed but I found more information on the infection. If of course it's the same strain. https://securityintelligence.com/news/new-emotet-trojan-feature-spreads-malware-on-internal-networks/ Thanks, |
captairwaves 1 Posts |
| Quote |
Jul 27th 2017 4 years ago |
|
Please check the following URL:
hxxp://911bob[.]com/KJFB766369/ I think it has to do with Emotet or something similar. |
Anonymous |
| Quote |
Jul 27th 2017 4 years ago |
|
Xme 641 Posts ISC Handler |
|
| Quote |
Jul 27th 2017 4 years ago |
|
Thanks for the write up! Just wanted to share a little more info on the 2nd day of malspam.
All the links I've found along with a regexp you can use to identify them can be found here: http://regexr.com/3gedi The 2nd day malicious document SHA256 is: dd1ec7b14c72b872a48ce9e4e60227a3d6ce93e6a730c8df4090f28eb7032e46 and the binary payload SHA256 is: 80d255de0c67759b592c072db8153f84d22f78226e1014720010f49739f7b63f Hope this helps anyone affected with their investigations. If anyone has information or theories on how the day 1 malspam was targeted, I'd be interested. |
22532 2 Posts |
| Quote |
Jul 27th 2017 4 years ago |
|
Did you save any logs from your webserver?
|
dray0n 1 Posts |
| Quote |
Jul 27th 2017 4 years ago |
Sign Up for Free or Log In to start participating in the conversation!
