The Emotet malware has resurfaced after a ten-month hiatus with multiple spam campaigns delivering malicious documents to mailboxes around the world.
See also: Emotet botnet is back with the help of Trickbot
Emotet is a malware infection distributed through spam campaigns with malicious attachments. If a user opens the attachment, malicious macros or JavaScript will download the Emotet DLL and load it into memory using PowerShell.
Once loaded, the malware will search for and steal emails for use in future spam campaigns and drop additional payloads such as TrickBot or Qbot, which usually lead to ransomware infections.
According to cybersecurity researcher Brad Duncan, spam campaigns use repetitive emails to trick the recipient into opening malicious Word, Excel, and ZIP file attachments that are password-protected.
Reply-chain phishing emails are when previously stolen email threads are used with fake replies to distribute malware to other users.
In the samples shared by Duncan, we can see Emotet using Reply-chains related to a “lost wallet,” a CyberMonday sale, canceled meetings, political donations, and the termination of a dental insurance policy.
See also: FBI: Published 4 million email addresses collected by Emotet
These emails contain attached Excel or Word documents with malicious macros, or a password-protected ZIP file attachment containing a malicious Word.
Currently, two different malicious documents are being distributed in the new Emotet spam campaigns.
The first is an Excel document template that states that the document only works on desktop or laptop computers and that the user must click "Enable Content" to view the contents properly.
The malicious Word attachment uses the "Red Dawn" template and says that since the document is in "Protected" mode, users must enable content and editing to view it properly.
When you open Emotet attachments, the document template will state that preview is unavailable and that you need to click "Enable Editing" and "Enable Content" to view the content properly.
However, once you click these buttons, malicious macros will be activated that launch a PowerShell command to download the Emotet loader DLL from a compromised WordPress website and save it to the C:\ProgramData.
After downloading, the DLL will be launched using C:\Windows\SysWo64\rundll32.exe, which will copy the DLL to a random folder under %LocalAppData% and then re-run the DLL from that folder.
See also: Emotet malware removed from all infected computers!
After some time, Emotet will configure a startup value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run to launch the malware when Windows starts.
The Emotet malware will remain silently running in the background, waiting for commands to be executed from its command and control server.
These commands could be to scan emails for theft, spread to other computers, or install additional payloads, such as the TrickBot or Qbot trojans.
