Emotet VBS

This sample is a suspected Emotet strain, obtained from MalwareBazaar. Through analysis it is determined to not have a clear familial attachment, but it is clear it is a complex, obfuscated, and multi-staged visual basic script for loading malicious payloads and persistence. Persistence is achieved through registry key edits via regsvr32.exe and external payloads are loaded through hardcoded domains. There is no apparent impact other than possible continued compromise, the infrastructure is inactive and no longer serving the final payload.

As of current it is impossible to fully determine the malware family this piece of code belongs to, however vendor detection's on Malware bazaar confidently point towards Emotet based on behaviors observed during runtime.

File Intelligence

Behavioral analysis

Static analysis

For static analysis I have unzipped, confirmed the file hash, and made a copy of the original file to deobfuscate and edit the code without losing the integrity of the original file.

Initial Stage

The initial VBS script is a stager, it first creates variables containing obfuscated strings which are then sliced and concatenated to a wscript call.

The script then creates a VBS FileSystem object which it then uses to generate a random folder within the Temp directory. It then also does the same thing to generate a random file name which it adds the .txt extension to.

After this it dumps about 1200 lines of VBS code into the file, waits 5000 seconds, then pipes it into a hidden command prompt with a wscript call.

Stage 2

Stage two at first glance has a repeating pattern of obfuscated ASCII codes separated by a custom delimiter \puk. The ASCII codes are also multiplied by 482, meaning to decode one needs to contatenate all of the strings, split them, then divide by 482 to get ASCII codes for a useful output. I wrote a quick python script to do that and I got a garbled output.

In this case the malicious actor is using carriage returns which was messing up my terminal output. Once properly sanitized another VBS payload emerges. This is directly executed from memory, nothing is directly written to disk between these stages.

Stage 3

Stage three is directly executed without being written to disk by stage two, however this stage begins persistence attempts. The script first initializes a few important file system , ADO stream, shell, and http request objects. It also defines a custom user agent field as well as the CLI registry editing tool regsvr32.exe

It then goes through the url's attempting to download a Zip file. This zip file is saved into the current directory with a random name. It also unpacks the archive, and moves into a new function. This function passes the written file into regsvr32.exe then overwrites the previous stage with a text file containing "baddum tss"

Attempts at downloading the Zip file for further analysis were unsuccessful. An HTML file was received from the domain esentai-gourmet[.]kz but there is nothing of note other than the Russian language language header and Russian text throughout the file. Presumably this malware would establish persistence in this next step while also executing some sort of payload.

Dynamic Analysis

N/A

IOC's

Network-based

Host-based

MITRE Mapping

References

https://bazaar.abuse.ch/sample/31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98/#intel
https://www.huntress.com/threat-library/malware/Emotet