Dead or Alive? An Emotet Story

MITRE Techniques

• [T1566.001] Phishing – The intrusion began after a user opened an Excel document and enabled macros. “Back in May, we witnessed an intrusion that started from a phishing email which included Emotet.”
• [T1117] Regsvr32 – Emotet used regsvr32.exe to load hvxda.ocx after obfuscated code: “The execution is done from an Excel document using regsvr32.exe with the payload, hvxda.ocx.”
• [T1105] Ingress Tool Transfer – Emotet downloaded Cobalt Strike via the loader process: “The Emotet DLL is then used to download Cobalt Strike, which is then injected into svchost and dllhost.”
• [T1055.001] Dynamic-link Library Injection – Process injection observed with svchost and other processes to execute payloads: “Process injection was observed during the intrusion by both Emotet and Cobalt Strike.”
• [T1059.001] PowerShell – PowerView and Invoke-ShareFinder used for network discovery: “the hands-on activity … invoked PowerView module, Invoke-Sharefinder.”
• [T1135] Network Share Discovery – Network enumeration via PowerView/Invoke-ShareFinder and subsequent AdFind usage: “Invoke-ShareFinder once again, and Invoke-Kerberoast.”
• [T1018] Remote System Discovery – Active discovery of remote systems during pivot: “Get-System module was also apparent via the logs.”
• [T1069.002] Domain Groups – Discovery and targeting of domain groups like Domain Admins and Enterprise Admins: “net group ‘Domain Admins’ … ‘Domain Computers’.”
• [T1087.002] Domain Accounts – Enumeration of domain accounts and roastable credentials: “Invoke-Kerberoast” for roastable accounts.
• [T1003.001] LSASS Memory – Credential dumping via LSASS memory: “then proceeded to dump credentials from LSASS.”
• [T1558.003] Kerberoasting – Kerberoast performed during lateral movement: “Invoke-Kerberoast.”
• [T1021.002] SMB/Windows Admin Shares – Lateral movement by transferring a Cobalt Strike DLL over SMB and executing via a remote service: “transferring a Cobalt Strike DLL over SMB and executing via a remote service on another workstation.”
• [T1570] Lateral Tool Transfer – Pivoting to domain controller and deploying tools like AdFind/Atera; batch scripts used for discovery and movement: “batch script named p.bat to ping all servers.”
• [T1003.003] LSASS Dump – Extended credential access through LSASS dumping on multiple hosts.
• [T1071.001] Web Protocols – Cobalt Strike beacons and Emotet C2 communications over HTTP/HTTPS: “beacon type: [ ‘HTTP’ ], server: { … }”
• [T1059.001] PowerShell – Use of PS-based discovery and tool execution (PowerView/Invoke-ShareFinder) as part of the attack chain.
• [T1547.001] Registry Run Keys / Startup Folder – Persistence on the beachhead via registry Run Key: “The Emotet infection on the beachhead host used a registry run key to maintain persistence.”
• [T1018] Remote System Discovery – Discovery of domain relationships and trusts during domain pivot.
• [T1021.001] Remote Services – Use of psexec-like technique to run remote processes on other hosts: “The Cobalt Strike jump psexec (Run service EXE on the remote host) produced a 7045 System Windows event on remote hosts.”
• [T1567.002] Exfiltration to Cloud Storage – Exfil to MEGA cloud storage using Rclone: “exfiltrate data to MEGA.io cloud storage.”