How spam campaigns can threaten regional transport hubs

Emotet is among the most widespread cybercriminal campaigns to date. Originally developed as a banking trojan to steal victims’ banking credentials, it eventually evolved in a vehicle to spread third party malware via large spam campaigns. Emotet developers have been collaborating for months with those of Trickbot and Qakbot to deliver ransomware, which means that an Emotet infection would likely lead to widespread system unavailability.

The most recent wave of Emotet emerged in July, and in September it was reportedly sending large amount of spam emails to Japan and New Zealand, among other target countries.  

DarkLab researchers found evidence that between August and September Emotet also targeted organisations in Hong Kong, a region previously unreported to be affected by this threat.

According to phishing emails uploaded to a popular malware repository, organisations in the retail, transport, and telecommunications sectors were among Emotet’s targets, although more companies are likely to have received their malicious emails.

Among the targets identified, particularly worrying is the presence of Hong Kong’s main airport. The organisation was very likely not compromised, or they would not have uploaded the phishing email to a malware repository, but as Emotet often leads to ransomware, a successful infection would have likely had serious impact on one of the largest airports in Asia Pacific.

Figure 1 – screenshot of Emotet phishing email to a Hong Kong victim

Attack chain analysis

DarkLab analysts observed that the emails were sent by Emotet’s epoch2 botnet, abusing or spoofing previously compromised organisations in other countries. The phishing emails contain MS Word attachments with relatively generic filenames such as invoice.doc and MJ-1759 report.doc. Upon opening the document, the user is enticed to click an enable content button, a standard technique to activate malicious macros.

Figure 2 – screenshot of MJ-1759 report.doc (MD5:e1b8b7b710a639b0697a5f3b5e6a00bb)

The heavily obfuscated malicious macros then load a base64-encoded Powershell script into memory, which is used to download an executable from one of seven hardcoded URLs. The use of multiple dropper sites is to ensure successful malware delivery even if one or more malicious sites are taken down

Figure 3 – decoded and partially deobfuscated powershell script reveals the dropper URLs (highlighted)

This first stage payload, which can have different names in different samples analysed, is by default saved in %TEMP%\APPDATA or USERFOLDER. When the first stage executable is run it gains persistence by copying itself in the system root folder with a different name, and by modifying registries entries to ensure that the process is run every time the endpoint boots up. The new executable in system root is the actual Emotet payload, named kbdrost.exe, and reaches out to a command and control server via a HTTP post request.

Figure 4 – Emotet’s connection to remote C2 IP following successful infection

According to previously observed behaviour, Emotet will eventually drop the Trickbot or Qakbot trojans, which will then deliver the Ryuk or Prolock ransomware respectively.

Emotet’s large spam campaigns and relatively sophisticated delivery mechanisms are likely to continue to pose a threat to companies in Asia Pacific in the foreseeable future. DarkLab’s discovery of Emotet’s targeting of Hong Kong organisations shows how companies in the region should maintain awareness of global threat trends to ensure effective network defences and a proactive approach to cyber security.

Indicators of Compromise

The following IOCs relate to the samples analysed, include the hardcoded C2 IP addresses. However, Emotet’s attack infrastructure changes rapidly. We suggest readers to refer to Cryptolaemus’ daily IOC lists for an updated and comprehensive overview of Emotet’s infrastructure.

Filename	SHA-256 Hash
MJ-1759 report.doc	5a378819ab9e17bc93ed9c3d01b31f2b1ff6c39cb3cbaff66933fe096a527450
kbdrost.exe	9f9ac55291000f55721ff0fcf8fd421d94eb0e2f0259c161a8d17b2cb0894fa0

Executable dropper URLs

hxxp://haymetetrading[.]com/wp-includes/yGELKj4/

hxxp://simofferbd24[.]com/wp-includes/fsiQc/

hxxp://401kplansinfo[.]com/cgi-bin/KtFRk/

hxxp://fidelityguide[.]com/cgi-bin/VA/

hxxp://sirnakmidyeci[.]com/wp-includes/qk9wW2/

hxxp://subitocarne[.]com/wp-content/ByeOAt9/

hxxp://eliesalibaarchitect[.]com/wordpress/T/

C2 IPs

24.43.32.186:80	176.111.60.55:8080	121.124.124.40:7080	75.139.38.211:80
38.111.46.46:8080	24.137.76.62:80	89.216.122.92:80	82.225.49.121:80
134.209.36.254:8080	37.187.72.193:8080	82.80.155.43:80	123.176.25.234:80
162.241.242.173:8080	110.145.77.103:80	47.144.21.12:443	194.187.133.160:443
74.120.55.163:80	153.137.36.142:80	93.147.212.206:80	62.30.7.67:443
61.92.17.12:80	1.221.254.82:80	200.123.150.89:443	109.74.5.95:8080
219.74.18.66:443	195.7.12.8:80	121.7.127.163:80	203.153.216.189:7080
156.155.166.221:80	110.5.16.198:80	200.114.213.233:8080	187.161.206.24:80
104.131.44.150:8080	110.5.16.198:80	94.200.114.161:80	157.245.99.39:8080
37.139.21.175:8080	185.94.252.104:443	24.179.13.119:80	195.251.213.56:80
94.1.108.190:443	104.236.246.93:8080	84.39.182.7:80	71.72.196.159:80
169.239.182.217:8080	78.24.219.147:8080	97.82.79.83:80	174.102.48.180:443
220.245.198.194:80	85.152.162.105:80	87.106.136.232:8080	181.169.34.190:80
139.99.158.11:443	85.105.205.77:8080	5.196.74.210:8080	140.186.212.146:80
91.211.88.52:7080	139.59.60.244:8080	5.196.74.210:8080	201.173.217.124:443
62.75.141.82:80	79.137.83.50:443	24.43.99.75:80	42.200.107.142:80
174.45.13.118:80	50.91.114.38:80	213.196.135.145:80	79.98.24.39:8080
137.119.36.33:80	172.91.208.86:80	94.23.237.171:443	5.39.91.110:7080
188.219.31.12:80	74.219.172.26:80	74.134.41.124:80	139.162.108.71:8080
103.86.49.11:8080	83.169.36.251:8080	96.249.236.156:443	74.208.45.104:8080
104.131.11.150:443	153.232.188.106:80	95.213.236.64:8080	61.19.246.238:443
124.41.215.226:80	209.141.54.221:8080	137.59.187.107:8080	50.35.17.13:80
78.187.156.31:80	168.235.67.138:7080	137.59.187.107:8080	95.179.229.244:8080
104.32.141.43:80	139.130.242.43:80	137.59.187.107:8080	216.139.123.119:80
107.5.122.110:80	68.188.112.97:80	219.75.128.166:80	120.150.60.189:80
87.106.139.101:8080	87.106.139.101:8080	–	–

Feel free to contact us at [darklab dot cti at hk dot pwc dot com] for any further information.