A community of personal researchers tracking spam “BARAMAKI”
Ken Sajo : JPCERT Coordination Center @bomccss
Shuhei Sasada : Cyber Defense Institute, Inc. @sugimu_sec

1.
2.
3.
4.
5.
6.
7.

Introduction
What is Emotet?
Impact of Emotet on Japan
Damage reduction measures
Emotet Campaign Analysis
Countermeasures
Summary1. Introduction

We are an individual member of the spam tracking community called"BARAMAKI".
This community is consist of CSIRT members at user side andsecurity researchers at vendor side.
<Motivation>
In order to reduce damages by malspam in Japan<Activity Overview>
The organization that receives the malspam
quickly share information, analyzes it together,and publicly sends out information necessary
for countermeasures.

<Speakers>@bomccss @sugimu_sec<Ref>50 unknown well-meaning people who protect Japan from scattered emails
https://xtech.nikkei.com/atcl/nxt/column/18/00138/072700596/

<Long-term observation of Emotet attacks>▪ Sharing received email templates▪ Emails received mainly by own organization▪ Analyze attack▫ Early alert▪ Share information with foreign researchersBased on the observed data, we will talk about an analysis of
attack campaigns aimed at infecting Emotet that havecaused serious damage in Japan since the second half of2019.
▪ Overview of infection▪ Impact in Japan▪ Purpose of attack* The time for this announcement is stated in JST (UTC + 0900).

2. What is Emotet?

<Features>▪ Compromise by opening malicious documents▪ Modular malware
▫
▫
▫
▫
▫

Stealing credentials
Spread over the network
Spread infected emails
Transfer of C2 communication

Infection with other malware via Emotet<When>
Since Japan was added to the attack list in September 2019, malicious
emails have been delivered.

▪ Compromised when opening an email attached document.
▪ Information is stolen and further spread activities

Receive email

EmotetDistribution site
(compromised)

1. Receive an email andcompromise

2. Steal information
Information theft（This section focuses on the theft ofemail-related information）

3. Infection spread activity
Infection spread（This section focuses on spreading
activities by email）

▪ Sent under the guise of abusiness partner or relatedorganization▪ The contents of stolen emails
may be abused▪ Document files,
password-protected zip files,
etc. are attached▪ Emails delivered in Japan are
mainly based on Japanese▪ Classify email type by following featurescontents of email
Scattered email

Reply chain type

Fake reply email●●

General-purpose content
There is no past reply history in the body and it is sent as a new
email

●
●

Sent as a reply to the stolen email
The history of past emails remains in the body●●

Many general-purpose contents (a type of scattered mail)At the end of the email body, the content disguised as a pastemail header starting with "---- Original Message ---" isdescribed.

personal nameemail account nameRecipient namesender email addressemail account nameRecipient namepersonal nameemail address
domain namesender email addressemail subject in history

email subject in history
email account nameRecipient namesender email addressemail account nameRecipient namesender email address

personal nameemail address
personal nameemail body in history

email body in historypersonal nameemail account nameRecipient namepersonal namesender email addressemail account nameRecipient namedomain namepersonal nameemail address
Recipient nameRecipient nameemail account nameemail account nameemail account namesender email addressDescription

Document fileemail
Attachment

Document file is attached(extension:.doc .docm .rtf )A password protected zip file isattached, the password is statedin a body of email（extension: .zip -> .doc）
A PDF file is attached, and the
document file will be downloaded
when you click the URL provided.
The URL is described in the bodyof the email, and clicking it will
download the document file.

Attachment

unzip
zip file

Attachment

URL link

download

PDF file

Compromised site

URL in email body

downloadCompromised site▪ Macro works when opening document file and enabling content▪ When the script is executed, Emotet is downloaded from thecommunication destination and executed.
▪ There is also a document file designed using Japanese▫ Clearly aimed at Japan▪ PowerShell script or JavaScript▪ Multiple URLs are stored in the executed script▫ Compromised site where Emotet is distributed (5~7URL)▫ Emotet downloads and runs when even one is active

http://aktuel.marduk.kim/dooxi-fuel-hf09b/Logs/
http://braam.com.br/c/oaA7YWWX/
http://zebaorganics.com/wp-admin/en-US/
http://friendsofchrist10.com/streamlabs-obs-rarso/SIGNUP/
http://guojiazui.com/b/y0QnnWbk/
http://fi.bonitastores.com/n/WUGoZ/
http://iog.com.cn/css/Sys/

Executed PowerShell script

Stored URLs

<update>▪ Fake error messages show up▪ Run DLL-formatted Emotet with rundll32.exe
Attack stop period(11/01-12/20)

2020/10/31

2020/12/21

▪ Infected with other malware▫ It depends on the time and environment▪ Receive the module according to the purpose from theC2 server▫ Example) Information stealer, spoofing email transmission,
forwarding of C2 traffice
Other malware
moduleC2 server
Information theft

Infection spreadcompromised by activities, etc.
Emotet▪ Emotet is modular malware▫ Information stealer module▫ Email information and browser information▫ Spam module▫ Scattered module and reply module▫ Network spreading module▫ UPnP module▪ Downloaded from C2 server according to purpose▪ No fraudulent money transfer modules have been identified since2017
Ref: https://eset-info.canon-its.jp/files/user/malware_info/images/ranking/pdf/MalwareReport_201910.pdf
https://research.checkpoint.com/2018/emotet-tricky-trojan-git-clones/▪
▪
▪

Rundll32.exe running Emotet launches multiple child processes▫ Copying a legitimate file and injecting it
Each file reads a .tmp file
The process with the argument /scomma is loaded with NirSoft tools
Process tree after opening a document filecertutil.exe
cmd.exe
Ref: https://www.mbsd.jp/blog/20181225_2.html（Confirmed on 2020/12/22）

▪ The extracted information is temporarily output to a file
▫ The file is deleted once the information is sent to the C2serverExtracted received email
Extracted email addressProcess flow▪ Spoofed login with stolen email account information▪ Deliver emails aimed at infection via a legitimate mail server
Email sending module
Stealed emailer setting
information
Stealed contacts
Email content

control

attacker

Login attempt
send email

Delivery of spoofed emails

Org A

Org A

Org Z

Org Z

Infected devices

Legitimate mail serverC2 servers
Mailer setting information
Stealed contacts
Content of stolen email

● Org A ・Org C mailer setting information● Org A ・Org C contacts, email content* This is an example of how a reply-type email is sent / received.

Org A

Org B
Business partners andrelated organizations

C2 servers● Email sending module● Mailer setting information stolen from
infected terminal● Contacts stolen from infected device● Email content

Infected hosts
Deliver emails to Org B by tricking Org A into using the email
address of Org C as an envelope FROM

Legitimate
mail server

Example of email received by Org B (reply type)
Subject：Re:先日の会議につきまして● Log in by misusing the mailer setting
information of the Org C terminal● send email

Org D

Org C

From : Org A name <Org C email address>
To : Org B email address
Attachment : 請求書.doc

Infected hosts

いつもお世話になります。
09月度の請求書をDOCにて送信いたします。
Below is the history of actual
よろしくお願いします。

Infected hosts

Legitimate
mail server

past emails

お世話になっております。
先日の開催しました会議にご参加いただき、▪ The stolen email account credentials are misused
Attempt to log in from infected hosts

3. Send email

Control

attacker

Email sending module
Email related information

C2 server

Login attempt
send e-mailInfected hosts

Ready for attackers to
read

Email spread

Legitimate mail servers

Receive email
Information stealer module

・Mailer setting information
・Address book・Email・subject・body・attachment

Stealed information
2. steal infomation

Download Distribution site
and run(copromised)
Emotet1. Receive emails , Infect Emotet

▪ There are three botnets▫ They are called Epoch1, Epoch2, and Epoch3.
▪ Unique information for each Epoch▫ Email templates, email address▫ URL of Emotet distribution sites▫ C2 lists and RSA keys included in Emotet▪ The main targets are different▫ Japan is a major target for Epoch3 (E3)

Ref: https://paste.cryptolaemus.com/emotet/2020/10/25/25-emotet-malware-IoCs_10-25-20.html

Infected hosts
Epoch 1

Epoch 2

Epoch 3email templateattachment

Destination

download
URL

Emotet

RSA key

C2 server▪ C2 server destination is stored in Emotet▪ Each Epoch has a maximum of 128 C2s▪ About 80% of C2 servers are Bot C2, therest is Tier 1 C2
▫ The BotC2 is an infected host with the UPnP module loaded.
▫ Forward communication to Tier1 C2▫ Tier 1 C2 is a compromised Linux server▪ And there is a Tier 2 C2 server▫ Tier1 C2 forwards communication to Tier2 C2▪ The main purpose is to prevent takedown▪ Other modules store the list of other C2 IP addresses
Ref: https://blog.lumen.com/emotet-illuminated-mapping-a-tiered-botnet-using-global-network-forensics/
https://hello.global.ntt/ja-jp/insights/blog/behind-the-scenes-of-the-emotet-infrastructure

C2 server hard coded on sample

Infected hosts

Tier1 C2
(compromised site)

Infected hosts

Bot C2 uPnP module(Infected hosts)

Infected hosts

Tier1 C2
Bot C2 uPnP module(compromised site)(Infected hosts)

Tier2 C2

▪ Evasion detection by antivirus software▫ Unique hash for each infected host
▫ Periodic update of Emotet (change of hash)▫ Up to 5 times a day▫ In addition to holidays such as Sat. and Sun., the attack
stop date is also updated
Number of changes in hash (daily)

Attack stop period (11/01~12/20)

Time (date)

Activity

Remarks

2019/04/12

Receive emails written in Japanese(Temporary)

Unconfirmed second
malwareJapan is targeted in earnest

Confirmed second
malwareIncreased number of infections due toreply emails

Emails that are not inJapanese

Attacks on Japan intensify

Email written in
Japanese

09/27
Around 2019/11
11/23
2020/02/06

Attacks stopped around the world

07/17

Attacks resume around the world

Time (date)activity

Remarks

2020/08/28

Japan became a target in all Epochs

Rapid increase in emails to
Japan

08/31

Increase in number of infections in Japan

Approximately 200% increase
compared to 28th

09/02

Password protected zip files have been
attached

09/25

Document files with Japanese design
started to be used

10/31

Attacks stopped around the world

12/21

Attacks resume around the world

Factors behind the rapid
increase in infection

Few to Japan

Emotet email sending date and Japan targeted date
Yellow :Emotet emails are sent,
not for JapanRed :Emotet emails are sent,
targeting Japan
Japan is included in thetarget in about half▪ Early attack▫ Machine translation from general English content▫ Contents and attachments disguised as documents and invoices▪ Themes that match the time will be used (from 2019/12)▫ Bonus, Christmas, COVID-19▪ Fluent Japanese text is used (from 2020/01)▫ Diversion from stolen emails and learning on the attacker side
▪ Reply type is used consistently▫ Templates are getting more and more complicatedtypesFirst seen

Last seen

countssubject (esample)

attachment (example)

remarks

invoice

2019/4/12

2020/8/13

8

請求書の送信47434999183 703679.doc

General2019/9/27

2020/10/17

37

ドキュメントPO# 08182020Ex.doc

invoice

2019/11/27

2020/12/30

62

請求書の件です。 [数字日付 ]請求書の件です。 167204 20200728.doc

bounus2019/12/9

2020/12/30

17

賞与支払届

12月賞与.doc

Christmas

2019/12/18

2020/12/29

6

メリークリスマス

メリークリスマス .doc

meeting notice2020/1/14

2020/2/3

16

会議開催通知会議開催通知 .doc

invitation to meeting

2020/1/17

2020/12/30

34

会議への招待 [宛先domain]

ビジネス会議への招待 .doc

COVID-19

2020/1/28

2020/9/15

7

山城南保健所福祉室 [日付]

通知 [日付].doc

meeting agenda

2020/8/12

2020/9/30

13

金曜日の次の会議の議題。

金曜日の会議のチェックリスト。

partner companies

2020/9/1

2020/10/28

25[宛先表示名 ]変化[日付].doc

Trendmicro

2020/9/3

2020/9/28

9トレンドマイクロ・

カスタマー満足度アンケー .doc

update2020/9/25

2020/10/28

14[宛先表示名 ]更新のご案内 .doc

Also used in reply type

Additions

2020/9/29

2020/10/20

9[宛先表示名 ]追加分も .doc

Also used in reply type

Also used in reply type

Number of emails addressed to .jp domain email addresses(Calculated based on observed email data, 2020/07-2021/01)

Attack temporarily
stopped(10/6-10/13)
Attack temporarily
stopped(9/6-9/13)

Attack temporarily stopped(11/1-12/20)*The actual number is difficult to show due to various reasons, but it is on the scale of 10,000

Number of email accounts stolen and abused in .jp domain(Calculated based on observed email data, 2020/07-2021/01)

Number of email accounts stolen and abused in .jp domain(Calculated based on observed email data,2019/09-2021/01)

Number of email accounts stolen and abused in .jp domain(Calculated based on observed email data, 2020/07-2021/01)

Attack temporarily
stopped (9/6-9/13)

Attack temporarily stopped(10/6-10/13)

Attack temporarily stopped (11/1-12/20)

Number of new email accounts stolen and abused in .jp domain(Calculated based on observed email data, 2020/07-2021/01)
Attack temporarily
stopped (9/6-9/13)

Attack temporarily stopped(10/6-10/13)

Attack temporarily stopped (11/1-12/20)

Cumulative number of email accounts stolen and abused in .jp domain(Calculated based on observed email data, 2020/07-2021/01)

Document file with Japanese design First
observation (9/25)

Password protected zip file
First observation (9/2)
Target on all Epoch(8/28)

Attack temporarily stopped(10/6-10/13)
Attack temporarily stopped (9/6-9/13)

Attack temporarily stopped (11/1-12/20)

<Points to remember>▪
▪

Only .jp (Japan included in others is not counted for convenience)
The number was abused by the sender of the email (red frame in thelower right figure), not the exact number of infections.

▫
▪

Multiple email accounts may be stolen from one device or none may
be stolen

Affected by the amount of email sent▫

If the amount of transmission issmall, the number ofobservations may decrease anddeviate from the tendency.

4. Damage reduction
measuresInformation sharing and alerting the latest Emotet trends
on Twitter etc.
Observing password protected zip

Response procedures after infection

▪ email template▫ New coronavirus-themed email▫ Emails that trick Trend Micro▪ Early detection of new methods▫ Use password protected zip files▪ Document file with Japanese design▪ Share payload URLs（Register with URLHaus）

▪ Alerts are mainly sent out by the community, but our companies
may help if necessary.
▪ 2019/11/27 JPCERT/CC Issued Emotet alert▫ 2019/12/02 Published blog How to Respond to Emotet
Infection (FAQ)
https://blogs.jpcert.or.jp/en/2019/12/emotetfaq.html
11/28 Chief Cabinet Secretary calls
attention to Emotet

▪ Emotet is a global threat, and there is a global group "Cryptolaemus” tocounter Emotet▫ Gathering security experts
from around the world▪ Cooperation to share informationfrom Japan▫ Information sharing as TTPs
▫ Complement the time zone
▪ Register the communication destination of Emotet in URLHaus▫ Anyone can block malicious traffic with URLHaus feed
Ref: https://paste.cryptolaemus.com/
https://www.zdnet.com/article/meet-the-white-hat-group-fighting-emotet-the-worlds-most-dangerous-malware/▪ Early detection of falsified sites▫ Site where document files are distributed▫ Site where Emotet itself is distributed▪ Contact the IT service provider Abuse▪ Contact the organization's CSIRT or security officer→ Reduce the number of new infections by cutting off
the flow of infection▪ Observe email addresses abused for sending▪ Notify abused email addresses▫ Be aware of the infection and have it dealt with
▫ More than 4,500 notifications so far▫ Most are personal email addresses such as ISPs
▪ Cases that have already been noticed and dealt with▪ Cases where the remedy is unknown / insufficient even if theyknow it▪ If necessary, consult with us by email or phone.

▪ It may be difficult to explain or respond depending on the otherparty▫ Need to be able to check for Emotet infection by yourself▪ Emotet has unique traces and naming conventions▫ Based on that, it is possible to check for infection.
▫ Propose a concept and request development→ Released EmoCheck
https://github.com/JPCERTCC/EmoCheck/releases

5. Emotet Campaign
Analysis▪ Two groups are involved in Emotet attacks▫ The side that delivers email using Emotet▫ Attack group operating Emotet▫ The side that uses Emotet to infect other malware▫ Another attack group that wants to use anothermalware▪ Two groups are involved in Emotet attacks
control

Email sending module
Email related information

Login attempt
send email

C2 servers

attacker

Infected hosts

Email spread

Legitimate mail servers
Receive email

moduleRequest,usage fee

Information steal

control
another malware
another
attackerC2 server for
another malware

Distribution site
Download and （compromised）
run Emotet

▪ Emotet is malware used by a single group▪ Attack groups are called Mealybugs, Mummy Spider,TA542, etc. (all the same)▫ Cryptolaemus calls Ivan
▪ Emotet is a tool for infecting other malware▫ They are getting royalties from another attack
group by infecting another malware

By increasing the number of infected hosts of Emotet▫ Increased chances of getting infected with another malware▫
▫

→ Increased profits
Strengthening the email sending infrastructure
Increase in new attack targets (email addresses)

A mechanism that can specialize in increasing the number of infected
hosts→Defenders need to reduce the number of infections

▪ Malware that infects after Emotet (2019/09-)
malwaretime

Infection

Ursnif

2019/09-10

only in Japan

Trickbot

2019/10-12, 2020/07-

also in Japan

Qakbot2020/07-also in Japan

Zloader

2020/09-

only in Japan

IcedID2020/10-

not in Japan▪ all banking trojan▪ Attack groups will be different for each malware▪ Secondary infection malware depends on the Geo
Location of the IP at the time of infection▫ Secondary infection in the target country, no
infection in non-target countries▪ Malware that is secondarily infected only in Japantargets Japan▫ Ursnif, Zloader▪ To reduce Emotet's attacks on Japan, it is also
effective to block the purpose of attack groups
targeting secondary infections.
Ref: https://d00rt.github.io/emotet_network_protocol/#country▪ Ursnif(Dreambot), Trickbot via Emotet▫ Ursnif and Ursnif via Emotet have the samesettings▫ Ursnif and Trickbot WebInjects URLs match→ Attack group is considered Ursnif-B[See JSAC2020 presentation]
https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_5_sajo-takeda-niwa_jp.pdf▪ This attack group is known to use an account called"Jer" in other reports
Ref: https://medium.com/csis-techblog/the-end-of-dreambot-a-loved-piece-of-gozi-24cc9bfc8122

▪ Trickbot is used by various attack groups▫ Not all Trickbot distributions are via Emotet, and some▪

Trickbot distributions via Emotet are Jer
WebInjects for Japan exists in one record group from October 15,
2019 to March 2020（About 30% of the total)▫ This user is considered Jer▫ After 2020/03, most record groups including the above forJapan have been deleted from Trickbot's WebInjects.
→ At the same time, Trickbot's attack group is said tohave migrated to more sophisticated Bazzar malware.

▪ Zloader▫ Observed only in Japan after 2020/09▫ Increased emails to Japan at the same time
▪ Zloader targeting Japan has 3 infection methods▫ Malware that infects after Emotet▫ Infection from malspam attached xls▫ Infection via Exploit-Kit▪ 3 types of Zloader have the same config and C2▫ The same group is attacking▫ WebInjects targeting Japanese financial institutions
Ref: https://www.lac.co.jp/lacwatch/people/20201106_002321.html

The attack vector is different, but somesettings, C2 server, etc. are the same
Botnet ID
attacker

SG

EmotetEmotet infected
hosts

Zloadermalspammalspam

Zloader

Exploit Kit

Zloader

C2 servers

manipulation
server

C2 servers

manipulation
server

WebInjects
r1

Web accessmanipulation
server

WebInjects
r1/r2

attackerC2 servers

WebInjects

▪ Each Ursnif and Zloader attack group attempts toinfect even without Emotet.
▫ Emotet is just one of the attack vectors▪ There are similarities between the two malware
campaigns▫ email subject, body
▫ Document design▫ WebInjects

▪ Emotet's Japanese document and xlsb that infects Zloader have the▪

same design, the image is the same hashJer used almost the same image in the past
▫ The image is mosaic due to hash modification

Emotet and zloader design

2018/12/28 Ursnif design2020/10/14 Zloader malspam▪ The body of the Zloader
malspam on 2020/10/14 is thesame as the malspam body of
Ursnif on 2017/06/13 –2017/11/22.
▪ In addition, the body of Zloader
malspam is the one used in thepast in Jer's Ursnif malspam
body.
Ref: https://www.jc3.or.jp/topics/vm_index.html
https://bomccss.hatenablog.jp/entry/2020/10/28/132546

2017/06/13 Ursnif malspam

▪ Target of WebInjects▫ Ursnif and Zloader are mainly targeted at banks and credit card▪

companies, and the target organizations are the same.
▫ Zloader's WebInjects are frequently added and changed and areconsidered to be under continuous development.
No other Web Injections for Japan targeting both banks and credit cardcompanies▫ In the past Ramnit, Panda Banker targeted credit card companies▫ Some of Ursnif target Japanese banks

Ref: https://blog.trendmicro.co.jp/archives/19291
https://www.botconf.eu/wp-content/uploads/2018/12/2018-J-Wyke-Tracking-actors-through-their-webinjects-.pdf

malspam

EmotetSamedesignmalwareC2 servers

Same

WebInjects

manipulation

Zloader

Zloader
attacker
Jer

Same email body
UrsnifUrsnifSame
URL

TrickbotSame targets

▪ The purpose of the attack group that operates Emotet
is financial profit, and spreading Emotet more will leadto profit.
▪ Ursnif and Zloader infected from Emotet are used by
the same attack group▫ Aim for money with Banking Trojan▫ It may change to other malware, but it is likely that
attacks will continue.
▪ Ransomware attacks via Emotet that occur overseas
may not occur very often in Japan.

6. Countermeasures

▪
▪
▪
▪
▪
▪

Keep your OS and software up to date
Keep your antivirus software pattern files up to date
Block emails aimed at infection
Disable macro autorun in document files
Prohibit communication to the outside by script
Block communications using IoCs
▫ Communication destination shared by URLHaus▫ IP address of C2 server shared by feodo.tracker▪ Set up multi-factor authentication for your email account▪ Restrict administrative shares▪ Regular alerts with the latest information▫ Especially on Twitter, the latest information is shared▫ paste.cryptolaemus.com

7. Summary▪ Explaining Emotet attack campaign targeting Japan▫ The Flow of attacks aimed at infection▫ Sharing the infection situation in Japan▫ Analysis attack groups that use Emotet
Attack campaigns targeting Emotet infections are changing
rapidly, so use the latest TTPs and IoCs from Twitter andother sources as a proactive countermeasure.
Let's all reduce Emotet infections.

@bomccss@sugimu_sec

Work with Community@abel1ma@waga_tw@58_158_177_102@wato_dn@gorimpthon@papa_anniekey@satontonton@catnap707@tiketiketikeke@autumn_good_35@00001B1A@AIR3_ytakeda@tachi4439@fumik0_@AES256bit@romonlyht@anemone_ﬁsh@ozuma5119@sepi140, Icon designed by Freepik from Flaticon@Sec_S_Owl