What’s up with Emotet?

Emotet is a malware family active since 2014, operated by a cybercrime group known as Mealybug or TA542. Although it started as a banking trojan, it later evolved into a botnet that became one of the most prevalent threats worldwide. Emotet spreads via spam emails; it can exfiltrate information from, and deliver third-party malware to, compromised computers. Emotet operators are not very picky about their targets, installing their malware on systems belonging to individuals as well as companies and bigger organizations.

In January 2021, Emotet was the target of a takedown as a result of an international, collaborative effort of eight countries coordinated by Eurojust and Europol. However, despite this operation, Emotet came back to life in November 2021.

Key points of this blogpost:

• Emotet launched multiple spam campaigns since it re-appeared after its takedown.
• Since then, Mealybug created multiple new modules and multiple times updated and improved all existing modules.
• Emotet operators subsequently have put a lot of effort into avoiding monitoring and tracking of the botnet since it came back.
• Currently Emotet is silent and inactive, most probably due to failing to find an effective, new attack vector.

Figure 1. Timeline of interesting Emotet events since its return

Spam campaigns

After the comeback followed by multiple spam campaigns at the end of 2021, the beginning of 2022 continued with these trends and we registered multiple spam campaigns launched by Emotet operators. During this time Emotet was spreading mainly via malicious Microsoft Word and Microsoft Excel documents with embedded VBA macros.

In July 2022, Microsoft changed the game for all the malware families like Emotet and Qbot – which had used phishing emails with malicious document as the method of spreading – by disabling VBA macros in documents obtained from the Internet. This change was announced by Microsoft at the beginning of the year and deployed originally in early April, but the update was rolled back due to user feedback. The final rollout came at the end of July 2022 and, as can be seen in Figure 2, the update resulted in a significant drop in Emotet compromises; we did not observe any significant activity during the summer of 2022.

Figure 2. Emotet detection trend, seven-day moving average

Disabling Emotet’s main attack vector made its operators look for new ways to compromise their targets. Mealybug started experimenting with malicious LNK and XLL files, but when the year 2022 was ending, Emotet operators struggled to find a new attack vector that would be as effective as VBA macros had been. In 2023, they ran three distinctive malspam campaigns, each testing a slightly different intrusion avenue and social engineering technique. However, the shrinking size of the attacks and constant changes in the approach may suggest dissatisfaction with the outcomes.

The first of those three campaigns happened around March 8^th, 2023, when the Emotet botnet started distributing Word documents, masked as invoices, with embedded malicious VBA macros. This was quite odd because VBA macros were disabled by Microsoft by default, so victims couldn’t run embedded malicious code.

In their second campaign between March 13^th and March 18^th, the attackers seemingly acknowledged these flaws, and apart from using the reply chain approach, they also switched from VBA macros to OneNote files (ONE) with embedded VBScripts. If the victims opened the file, they were greeted by what looked like a protected OneNote page, asking them to click a View button to see the content. Behind this graphic element was a hidden VBScript, set to download the Emotet DLL.

Despite a OneNote warning that this action might lead to malicious content, people tend to click at similar prompts by habit and thus can potentially allow the attackers to compromise their devices.

The last campaign observed in ESET telemetry was launched on March 20^th, taking advantage of the upcoming income tax due date in the United States. The malicious emails sent by the botnet pretended to come from the US tax office Internal Revenue Service (IRS) and carried an attached archive file named W-9 form.zip. The included ZIP file contained a Word document with an embedded malicious VBA macro that the intended victim probably had to enable. Apart from this campaign, targeted specifically to the USA, we also observed another campaign using embedded VBScripts and OneNote approach that was underway at the same time.

As can be seen in Figure 3, most of the attacks detected by ESET were aimed at Japan (43%), Italy (13%), although these numbers may be biased by the strong ESET user base in these regions. After removing those top two countries (in order to focus on the rest of the world), in Figure 4 it can be seen that the rest of the world was also hit, with Spain (5%) in third place followed by Mexico (5%) and South Africa (4%).

Figure 3. Emotet detections Jan 2022 – Jun 2023

Figure 4. Emotet detections Jan 2022 – Jun 2023 (JP and IT excluded)

Enhanced protection and obfuscations

After its reappearance, Emotet got multiple upgrades. The first notable feature is that the botnet switched its cryptographic scheme. Before the takedown, Emotet used RSA as their primary asymmetric scheme and after the reappearance, the botnet started to use Elliptic curve cryptography. Currently every Downloader module (also called Main module) comes with two embedded public keys. One is used for the Elliptic curve Diffie Hellman key exchange protocol and the other is used for a signature verification – Digital signature algorithm.

Apart from updating Emotet malware to 64-bit architecture, Mealybug has also implemented multiple new obfuscations to protect their modules. First notable obfuscation is control flow flattening which can significantly slow down analysis and locating interesting parts of code in Emotet’s modules.

Mealybug also implemented and improved its implementation of many randomization techniques, of which the most notable are the randomization of order of structure members and the randomization of instructions that calculate constants (constants are masked).

One more update that is worth mentioning happened during the last quarter of 2022, when modules started using timer queues. With those, the main function of modules and the communication part of modules were set as a callback function, which is invoked by multiple threads and all of this is combined with the control flow flattening, where the state value that manages which block of code is to be invoked is shared among the threads. This obfuscation adds up to another obstacle in analysis and makes following of the execution flow even more difficult.

New modules

To remain profitable and prevalent malware, Mealybug implemented multiple new modules, shown in yellow in Figure 5. Some of them were created as a defensive mechanism for the botnet, others for more efficient spreading of the malware, and last but not least, a module that steals information that can be used to steal the victim’s money.

Figure 5. Emotet’s most frequently used modules. Red existed before the takedown; yellow appeared after the comeback

Thunderbird Email Stealer and Thunderbird Contact Stealer

Emotet is spread via spam emails and people often trust those emails, because Emotet successfully uses an email thread hijacking technique. Before the takedown, Emotet used modules we call Outlook Contact Stealer and Outlook Email Stealer, that were capable of stealing emails and contact information from Outlook. But because not everyone uses Outlook, after the takedown Emotet focused also on a free alternative email application – Thunderbird.

Emotet may deploy a Thunderbird Email Stealer module to the compromised computer, which (as the name suggests) is capable of stealing emails. The module searches through the Thunderbird files containing received messages (in MBOX format) and steals data from multiple fields including sender, recipients, subject, date, and contents of the message.  All stolen information is then sent to a C&C server for further processing.

Together with Thunderbird Email Stealer, Emotet also deploys a Thunderbird Contact Stealer, which is capable of stealing contact information from Thunderbird. This module also searches through the Thunderbird files, this time looking for both received and sent messages. The difference is that this module just extracts information from the From:, To:, CC: and Cc: fields and creates an internal graph of who communicated with whom, where nodes are people, and there is an edge between two people if they communicated with each other. In the next step, the module orders the stolen contacts – starting with the most interconnected people – and sends this information to a C&C server.

All this effort is complemented by two additional modules (that existed already before the takedown) - the MailPassView Stealer module and the Spammer module. MailPassView Stealer abuses a legitimate NirSoft tool for password recovery and steals credentials from email applications. When stolen emails, credentials, and information about who is in contact with whom gets processed, Mealybug creates malicious emails that look like a reply to previously stolen conversations and sends those emails together with the stolen credentials to a Spammer module that uses those credentials to send malicious replies to previous email conversations via SMTP.

Google Chrome Credit Card Stealer

As the name suggests, Google Chrome Credit Card Stealer steals information about credit cards stored in the Google Chrome browser. To achieve this, the module uses a statically linked SQLite3 library for accessing the Web Data database file usually located in %LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data. The module queries the table credit_cards for name_of_card, expiration_month, expiration_year, and card_number_encrypted, containing information about credit cards saved in the default Google Chrome profile. In the last step, the card_number_encrypted value is decrypted using the key stored in the %LOCALAPPDATA%\Google\Chrome\User Data\Local State file and all information is sent to a C&C server.

Systeminfo and Hardwareinfo modules

Shortly after the return of Emotet, in November 2021 a new module we call Systeminfo appeared. This module collects information about a compromised system and sends it to the C&C server. Information collected consists of:

• Output of the systeminfo command
• Output of the ipconfig /all command
• Output of the nltest /dclist: command (removed in Oct. 2022)
• Process list
• Uptime (obtained via GetTickCount) in seconds (removed in Oct 2022)

In October 2022 Emotet’s operators released another new module we call Hardwareinfo. Even though it doesn’t steal exclusively information about the hardware of a compromised machine, it serves as a complementary source of information to the Systeminfo module. This module collects the following data from the compromised machine:

• Computer name
• Username
• OS version information, including major and minor version numbers
• Session ID
• CPU brand string
• Information about RAM size and usage

Both modules have one primary purpose – verify whether the communication comes from legitimately compromised victim or not. Emotet was, especially after its comeback, a really hot topic in the computer security industry and among researchers, so Mealybug went to great lengths to protect themselves from tracking and monitoring of their activities. Thanks to the information collected by these two modules that not only collect data, but also contain anti-tracking and anti-analysis tricks, Mealybug’s capabilities to tell apart real victims from malware researchers’ activities or sandboxes were significantly improved.

What’s next?

According to ESET research and telemetry, both Epochs of the botnet have been quiet since the beginning of the April 2023. Currently it remains unclear if this is yet another vacation time for the authors, if they struggle to find new effective infection vector, or if there is someone new operating the botnet.

Even though we cannot confirm the rumors that one or both Epochs of the botnet were sold to somebody in January 2023, we noticed an unusual activity on one of the Epochs. The newest update of the downloader module contained a new functionality, which logs the inner states of the module and tracks its execution to a file C:\JSmith\Loader (Figure 6, Figure 7). Because this file has to be existing to actually log something, this functionality looks like a debugging output for someone who doesn’t completely understand what the module does and how it works. Furthermore, at that time the botnet was also widely spreading Spammer modules, which are considered to be more precious for Mealybug because historically they used these modules only on machines that were considered by them to be safe.

Figure 6. Logging of behavior of the downloader module

Figure 7. Logging of behavior of the downloader module

Whichever explanation of why the botnet is quiet now is true, Emotet has been known for its effectiveness and its operators made an effort to rebuild and maintain the botnet and even add some improvements, so keep track with our blog to see what the future will bring us.

For any inquiries about our research published on WeLiveSecurity, please contact us at threatintel@eset.com.
ESET Research offers private APT intelligence reports and data feeds. For any inquiries about this service, visit the ESET Threat Intelligence page.

IoCs

Files

Network

MITRE ATT&CK techniques

This table was built using version 12 of the MITRE ATT&CK enterprise techniques.