{"id":18574,"date":"2022-03-23T11:40:23","date_gmt":"2022-03-23T19:40:23","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/03\/23\/news-12307\/"},"modified":"2022-03-23T11:40:23","modified_gmt":"2022-03-23T19:40:23","slug":"news-12307","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/03\/23\/news-12307\/","title":{"rendered":"MS Office Files Involved Again in Recent Emotet Trojan Campaign \u2013 Part II"},"content":{"rendered":"
\n
\n
<\/div>\n<\/p><\/div>\n
\n

Affected platforms:<\/b> Microsoft Windows
Impacted parties:<\/b> 64-bit Windows Users
Impact:<\/b> Controls a victim\u2019s device and collects sensitive information
Severity level:<\/b> Critical <\/p>\n

Fortinet\u2019s FortiGuard Labs<\/a> recently captured more than 500 Microsoft Excel files involved in a campaign to deliver a fresh Emotet Trojan onto the victim\u2019s device.<\/p>\n

Emotet, known as a modular Trojan, was first discovered in the middle of 2014. Since then, it has become very active, continually updating itself. It has also been highlighted in cybersecurity news from time to time. Emotet uses social engineering, like email, to lure recipients into opening attached document files (including Word, Excel, PDF, etc.) or to click links within the content of the email that downloads the latest Emotet variant onto the victim\u2019s device and then executes it.<\/p>\n

In Part I of this post<\/a>, I explained how this variant of Emotet is spread by malicious VBA code in Excel documents, how the downloaded Emotet malware runs within a Rundll32 program, what kind of anti-analysis techniques this variant uses., how it encrypts and submits its victim\u2019s data to its C2 server., what Emotet does when it receives response data from the C2 server, and what Emotet does to enable persistence on the victim\u2019s device.<\/p>\n

In this post, you will learn what the data in response packets with malicious modules look like, what modules have been received from the C2 server for the current Emotet campaign, and how they are deployed in the victim\u2019s device. You will also discover what sensitive data those modules steal from a victim\u2019s device.<\/p>\n

When X.dll Receives a Response with a Module<\/b><\/h2>\n

Once the C2 server has processed and detected the first submitted packet that includes critical data\u2014such as the victim\u2019s device system version, Windows architecture, etc.\u2014it replies with malicious modules for Emotet to execute in the victim\u2019s device. All the received modules are fileless. That is, they only exist in memory and are processed by the X.dll (the core of Emotet) running in Rundll32.exe.<\/p>\n<\/p><\/div>\n