Accélérez votre parcours Security Service Edge. Rejoignez Netskope chez RSA.

  • Produits de périphérie du service de sécurité

    Protégez-vous contre les menaces avancées et compatibles avec le cloud et protégez les données sur tous les vecteurs.

  • Borderless SD-WAN

    Fournissez en toute confiance un accès sécurisé et performant à chaque utilisateur, appareil, site et cloud distant.

  • Plateforme

    Une visibilité inégalée et une protection des données et des menaces en temps réel sur le plus grand cloud privé de sécurité au monde.

Netskope reconnu comme un des leaders dans le rapport du Magic Quadrant™ 2022 du Gartner dédié au SSE

Recevoir le rapport Présentation des produits
Netskope gartner mq 2022 leader sse
Réponse rapide de Gartner® : Quel est l'impact de l'acquisition d'Infiot par Netskope sur les projets SD-WAN, SASE et SSE ?

Recevoir le rapport
Gartner quick answer
Netskope offre une solution moderne de sécurité du cloud, dotée de fonctions unifiées en matière de protection des données et de détection des menaces, et d'un accès privé sécurisé.

Découvrir notre plateforme
Vue aérienne d'une métropole
Optez pour les meilleurs services de sécurité cloud du marché, avec un temps de latence minimum et une fiabilité élevée.

Plus d'informations
Lighted highway through mountainside switchbacks
Neutralisez les menaces qui échappent souvent à d'autres solutions de sécurité à l'aide d'un framework SSE unifié.

Plus d'informations
Lighting storm over metropolitan area
Solutions Zero Trust pour les déploiements du SSE et du SASE

Plus d'informations
Boat driving through open sea
Netskope permet à toutes les entreprises d'adopter des services et des applications cloud ainsi que des infrastructures cloud publiques rapidement et en toute sécurité.

Plus d'informations
Wind turbines along cliffside
  • Nos clients

    Netskope sert plus de 2 000 clients dans le monde, dont plus de 25 des entreprises du classement Fortune 100

  • Solutions pour les clients

    Nous sommes là pour vous et avec vous à chaque étape, pour assurer votre succès avec Netskope.

  • Formation et certification

    Avec Netskope, devenez un expert de la sécurité du cloud.

Nous parons nos clients à l'avenir, quel qu'il soit

Voir nos clients
Woman smiling with glasses looking out window
L’équipe de services professionnels talentueuse et expérimentée de Netskope propose une approche prescriptive pour une mise en œuvre réussie.

Plus d'informations
Services professionnels Netskope
Sécurisez votre parcours de transformation numérique et tirez le meilleur parti de vos applications cloud, Web et privées grâce à la formation Netskope.

Plus d'informations
Group of young professionals working
  • Ressources

    Découvrez comment Netskope peut vous aider à sécuriser votre migration vers le Cloud.

  • Blog

    Découvrez comment Netskope permet de transformer la sécurité et les réseaux à l'aide du Security Service Edge (SSE).

  • Événements et ateliers

    Restez à l'affût des dernières tendances en matière de sécurité et créez des liens avec vos pairs.

  • Définition de la sécurité

    Tout ce que vous devez savoir dans notre encyclopédie de la cybersécurité.

Podcast Security Visionaries

Episode 10 : Construire des relations de sécurité par la transparence
In this episode, Mike and Andreas discuss aligning with works councils, forging business relationships through transparency, and embedding security into value streams.

Écouter le podcast
Building Security Relationships Through Transparency
Découvrez comment Netskope permet de passer au Zero Trust et au modèle SASE grâce aux fonctions du Security Service Edge (SSE).

Lire le blog
Sunrise and cloudy sky
Netskope at RSA

Join Netskope at RSA Conference this year and be part of the real conversations on SASE and Zero Trust. Stop by our booth in South Hall, chat with an expert, register for our speaking sessions, and unwind by joining us at one of our events!

Plus d'informations
RSA logo
Qu'est-ce que le Security Service Edge ?

Découvrez le côté sécurité de SASE, l'avenir du réseau et de la protection dans le cloud.

Plus d'informations
Four-way roundabout
  • Entreprise

    Nous vous aidons à conserver une longueur d'avance sur les défis posés par le cloud, les données et les réseaux en matière de sécurité.

  • Pourquoi Netskope

    La transformation du cloud et le travail à distance ont révolutionné le fonctionnement de la sécurité.

  • Équipe de direction

    Nos dirigeants sont déterminés à faciliter la réussite de nos clients.

  • Partenaires

    Nous collaborons avec des leaders de la sécurité pour vous aider à sécuriser votre transition vers le cloud.

Netskope permet l'avenir du travail.

En savoir plus
Curvy road through wooded area
Netskope redéfinit la sécurité du cloud, des données et des réseaux afin d'aider les entreprises à appliquer les principes Zero Trust pour protéger leurs données.

Plus d'informations
Switchback road atop a cliffside
Penseurs, concepteurs, rêveurs, innovateurs. Ensemble, nous fournissons le nec plus ultra des solutions de sécurité cloud afin d'aider nos clients à protéger leurs données et leurs collaborateurs.

Rencontrez notre équipe
Group of hikers scaling a snowy mountain
La stratégie de commercialisation de Netskope privilégie ses partenaires, ce qui leur permet de maximiser leur croissance et leur rentabilité, tout en transformant la sécurité des entreprises.

Plus d'informations
Group of diverse young professionals smiling

Emotet: Still Abusing Microsoft Office Macros

Jun 27 2022

Summary

In April 2022, Netskope Threat Labs analyzed an Emotet campaign that was using LNK files instead of Microsoft Office documents, likely as a response to the protections launched by Microsoft in 2022 to mitigate attacks via Excel 4.0 (XLM) and VBA macros.

However, we recently came across hundreds of malicious Office documents that are being used to download and execute Emotet, indicating that some attackers are still using old delivery methods in the wild. Despite the protection Microsoft released in 2022 to prevent the execution of Excel 4.0 (XLM) macros, this attack is still feasible against users who are using outdated versions of Office. It is also feasible against users who have changed the default setting to explicitly enable macros. The fact that attackers are still using Excel 4.0 Macros indicates that outdated Office versions and users who have this protection disabled are still common.

Screenshot of option to enable Excel 4.0 Macros.
Option to enable Excel 4.0 Macros.

By searching for similar files on VirusTotal, we found 776 malicious spreadsheets submitted between June 9, 2022 and June 21, 2022, which abuse Excel 4.0 (XLM) macros to download and execute Emotet’s payload. Most of the files share the same URLs and some metadata. We extracted 18 URLs out of the 776 samples, four of which were online and delivering Emotet.

Graph showing submission timeline for Emotet spreadsheets on VirusTotal.
Submission timeline for Emotet spreadsheets on VirusTotal.

In this blog post, we will analyze this Emotet campaign, showing the delivery mechanism to the last payload.

Stage 01 – Malicious Spreadsheets

The first stage is a malicious spreadsheet that abuses Excel 4.0 (XLM) macros to download and execute Emotet. These files are being delivered as email attachments.

Examples of phishing emails with malicious spreadsheets attached.
Phishing emails with malicious spreadsheets attached.

There are also cases where the spreadsheet is attached within a password-protected ZIP file.

The spreadsheet contains a message to lure the user to remove the protected view by clicking the “Enable Editing” button.

Example of spreadsheet message asking to click “Enable Editing”.
Spreadsheet message asking to click “Enable Editing”.

The malicious code is obfuscated and spread across hidden spreadsheets and cells.

Screenshot of part of the Excel 4.0 Macros.
Part of the Excel 4.0 Macros.

The code downloads the payload from an external URL via “URLDownloadToFileA” API and executes it with “regsvr32.exe”, which is a commonly used binary for the Living-off-the-Land technique.

Screenshot of deobfuscated code from the spreadsheet.
Deobfuscated code from the spreadsheet.

Furthermore, most of the files we analyzed were authored by “Dream” and last saved either by “RHRSDJTJDGHT” or “TYHRETH“, indicating the files likely share an author. 

Screenshot of common metadata across the spreadsheets.
Common metadata across the spreadsheets.

Stage 02 – Packed Emotet

We were able to download samples from four different URLs out of the 18 extracted from the spreadsheets. Two of the downloaded files were unpacking the same Emotet payload.

Example of four payloads downloaded from the spreadsheet URLs.
Four payloads downloaded from the spreadsheet URLs.

Emotet’s main payload is encrypted and stored in the PE resources of the loader, which is the same case as other Emotet packed samples we analyzed earlier in 2022.

Screenshot of Emotet’s main payload stored in the PE resources.
Emotet’s main payload stored in the PE resources.

The unpacking/decryption process is also very similar to the samples we analyzed earlier in 2022, where a key is used in a simple rolling XOR algorithm.

Example of Emotet decryption process.
Emotet decryption process.

Stage 03 – Emotet Payload

We extracted three different payloads (64-bit DLLs) from the samples we downloaded from the URLs. 

Screenshot of main Emotet payloads
Main Emotet payloads.

We can find some similarities by comparing these payloads with the ones we analyzed in April 2022, like the pattern used in the DLL name.

Screenshot of real name for all three samples is “E.dll”.
Real name for all three samples is “E.dll”.

And also the persistence mechanism via Windows service that executes the payload via regsvr32.exe.

Screenshot of Emotet persistence mechanism.
Emotet persistence mechanism.

However, there are some differences between these payloads and the ones we analyzed in April 2022. The first one is where and how Emotet decrypts its strings. In previous payloads, Emotet was storing its strings in the PE .text section.

In these latest payloads, Emotet uses functions to retrieve decrypted strings. Simply put, the attacker is using the concept of stack strings, which are passed via parameter to the function that performs the decryption process.

Screenshot of Emotet function to return a decrypted string.
Emotet function to return a decrypted string.

The decrypted strings can be easily retrieved by placing breakpoints in the return of these functions. Also, it’s possible to use a Python script to automatically extract this data using Dumpulator or any other emulation framework.

Screenshot of Emotet decrypted strings.
Emotet decrypted strings.

The C2 addresses are also retrieved in a different way on these payloads. Instead of storing this data in the PE .data section, Emotet parses the C2 addresses via functions as well.

Example of Emotet parsing the C2 server addresses.
Emotet parsing the C2 server addresses.

And it’s also possible to extract this information statically using an emulation script, similar to the one used for the strings.

Screenshot of part of Emotet C2 server addresses.
Part of Emotet C2 server addresses.

Conclusions

In April 2022 we analyzed an Emotet campaign that was not using Microsoft Office files to spread, as a possible response to Microsoft protections. However, we still see some attackers abusing Microsoft Office files to download and execute Emotet. We strongly recommend users to update Microsoft Office to its latest versions. Also, IT administrators may also completely block Excel 4.0 (XLM) Macros via Group Policy.

Protection

Netskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat indicators and payloads. 

  • Netskope Threat Protection
    • Document-Excel.Trojan.Emotet
    • Win64.Trojan.Emotet
  • Netskope Advanced Threat Protection provides proactive coverage against this threat.
    • Gen.Malware.Detect.By.StHeur indicates a sample that was detected using static analysis
    • Gen.Malware.Detect.By.Sandbox indicates a sample that was detected by our cloud sandbox

IOCs

All the IOCs related to this campaign, scripts, and the Yara rules can be found in our GitHub repository.

author image
Gustavo Palazolo
Gustavo Palazolo is an expert in malware analysis, reverse engineering and security research, working many years in projects related to electronic fraud protection. He is currently working on the Netskope Research Team, discovering and analyzing new malware threats.