All You Need to Know About Emotet in 2022

For 6 months, the infamous Emotet botnet has shown almost no
activity, and now it’s distributing malicious spam. Let’s dive into
details and discuss all you need to know about the notorious
malware to combat it.

Why is everyone scared of Emotet?

Emotet^[1]
is by far one of the most dangerous trojans ever created. The
malware became a very destructive program as it grew in scale and
sophistication. The victim can be anyone from corporate to private
users exposed to spam email campaigns.

The botnet distributes through phishing containing malicious
Excel or Word documents. When users open these documents and enable
macros, the Emotet DLL downloads and then loads into memory.

It searches for email addresses and steals them for spam
campaigns. Moreover, the botnet drops additional payloads, such as
Cobalt Strike or other attacks that lead to ransomware.

The polymorphic nature of Emotet, along with the many modules it
includes, makes the malware challenging to identify. The Emotet
team constantly changes its tactics, techniques, and procedures to
ensure that the existing detection rules cannot be applied. As part
of its strategy to stay invisible in the infected system, the
malicious software downloads extra payloads using multiple
steps.

And the results of Emotet behavior are devastating for
cybersecurity specialists: the malware is nearly impossible to
remove. It spreads quickly, generates faulty indicators, and adapts
according to attackers’ needs.

How has Emotet upgraded over the years?

Emotet is an advanced and constantly changing modular botnet.
The malware started its journey as a simple banking trojan in 2014.
But since then, it has acquired a bunch of different features,
modules, and campaigns:

• 2014. Money transfer, mail spam, DDoS, and address book
  stealing modules.
• 2015. Evasion functionality.
• 2016. Mail spam, RIG 4.0 exploit kit, delivery of other
  trojans.
• 2017. A spreader and address book stealer module.
• 2021. XLS malicious templates, uses MSHTA, dropped by Cobalt
  Strike.
• 2022. Some features remained the same, but this year also
  brought several updates.

This tendency proves that Emotet isn’t going anywhere despite
frequent “vacations” and even the official shutdown. The malware
evolves fast and adapts to everything.

What features has a new Emotet 2022 version acquired?

After almost half a year of a break, the Emotet botnet returned
even stronger. Here is what you need to know about a new 2022
version:

• It drops IcedID, a modular banking trojan.
• The malware loads XMRig, a miner that steals wallet data.
• The trojan has binary changes.
• Emotet bypasses detection using a 64-bit code base.
• A new version uses new commands:

Invoke rundll32.exe with a random named DLL and the export
PluginInit

The Emotet’s Excel lure

How to detect Emotet?

The main Emotet challenge is to detect it in the system quickly
and accurately. Besides that, a malware analyst should understand
the botnet’s behavior to prevent future attacks and avoid possible
losses.

With its long story of development, Emotet stepped up in the
anti-evasion strategy. Through the evolution of the process
execution chain and malware activity inside the infected system
changes, the malware has modified detection techniques
drastically.

For example, in 2018, it was possible to detect this banker by
looking at the name of the process – it was one of these:

Later, in the first quarter of 2020, Emotet started to create
specific key into the registry – it writes into the key
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER
value with the length 8 symbols (letters and characters).

Of course, Suricata rules always identify this malware, but
detection systems often continue beyond the first wave because
rules need to update.

Another way to detect this banker was its malicious documents –
crooks use specific templates and lures, even with grammatical
errors in them. One of the most reliable ways to detect Emotet is
by the YARA rules.

To overcome malware’s anti-evasion techniques and capture the
botnet – use a malware sandbox as the most convenient tool for this
goal. In ANY.RUN^[2], you can not only
detect, monitor, and analyze malicious objects but also get already
extracted configurations from the sample.

There are some features that you use just for Emotet
analysis:

• reveal C2 links of a malicious sample with the FakeNet
• use Suricata and YARA rulesets to successfully identify the
  botnet
• Get data about C2 servers, keys, and strings extracted from the
  sample’s memory dump
• gather fresh malware’s IOCs

The tool helps to perform successful investigations quickly and
precisely, so malware analysts can save valuable time.

ANY.RUN sandbox has prepared incredible deals for Black
Friday 2022! Now is the best time to boost your malware
analysis and save some money! Check out special offers^[3]
for their premium plans but for a limited time – from 22-29
November, 2022.

Emotet has not demonstrated full functionality and consistent
follow-on payload delivery. Use modern tools like ANY.RUN online
malware sandbox to improve your cybersecurity and detect this
botnet effectively. Stay safe and good threat hunting!