mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Files

T

Desiree Beck c3033e4061 Staging (#162 )

* update staging (#158)

* update format/wording

* Capa 7.1 rule updates (#156)

* Update self-deletion.md

Added CAPA rule "self delete using alternate data streams" (https://github.com/mandiant/capa-rules/blob/v7.1.0/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml)

* Update obfuscated-files-or-information.md

added new CAPA rule "encrypt data using RC4 via SystemFunction033" https://github.com/mandiant/capa-rules/blob/v7.1.0/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml

* Update disk-wipe.md

Added capa rule "https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml" https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml

* Update system-information-discovery.md

Added new CAPA rule "get disk information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-disk-information-via-ioctl.yml

* Update system-information-discovery.md

Added new CAPA rule "get volume information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-volume-information-via-ioctl.yml

* Update dns-communication.md

Removed duplication in APIs in "Resolve DNS" CAPA rule

* Update socket-communication.md

Updated APIs for "create raw socket" CAPA rule

* Update socket-communication.md

Updated APIs on CAPA rule "get socket status"

* Update socket-communication.md

Updated CAPA rule "initialize Winsock library"

* Update socket-communication.md

Updated API listing on CAPA rule "receive data on socket"

* Update socket-communication.md

Updated API listing for "send data on socket" CAPA rule

* Update socket-communication.md

Update APIs for CAPA rule "set socket configuration"

* Update socket-communication.md

Updated CAPA rule "connect tcp socket" to add APIs

* Update socket-communication.md

Added APIs to CAPA rule "create tcp socket"

* Update socket-communication.md

Added APIs to "create UDP socket" CAPA rule

* Update encrypt-data.md

Added new APIs to "encrypt data using DPAPI" CAPA rule

* Update install-driver.md

Added APIs to CAPA rule "install driver"

* Update set-file-attributes.md

Added APIs to CAPA rule "change file permissions on Linux"

* Update writes-file.md

Updated APIs for CAPA rule "write file on linux"

* Update system-information-discovery.md

Removed API from CAPA rule "get disk size" to align with published CAPA rule in v. 7.1

* Update create-process.md

Added API to "create process on linux" CAPA rule

* Update hijack-execution-flow.md

Added API calls to CAPA rule "execute shellcode via Windows callback function"

* Update self-deletion.md

Changed link to master

* Update obfuscated-files-or-information.md

Changed rule link to release to point to master

* Update system-information-discovery.md

Removed nursery rules

* Update disk-wipe.md

Updated link to master branch

* Update socket-communication.md

Checked for correct socket listings under the APIs

---------

Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>

* New method (#159)

* update format/wording

* Update disassembler-evasion.md

* Update disassembler-evasion.md

* Corpus fix (#160)

* update format/wording

* fix tables

* Edits

---------

Co-authored-by: ryan <ryanxu@wustl.edu>

* New method (#161)

* update format/wording

* Update disassembler-evasion.md

* Update disassembler-evasion.md

---------

Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>
Co-authored-by: ryan <ryanxu@wustl.edu>

2024-08-25 10:09:33 -04:00

4.0 KiB

Raw Permalink Blame History

ID	X0028
Type	Trojan (banking trojan)
Aliases	Geodo
Platforms	Windows
Year	2018
Associated ATT&CK Software	None

Emotet

Emotet is a banking trojan. [1]

ATT&CK Techniques

Name	Use
Execution::Shared Modules (T1129)	Emotet parses PE headers. [6]

Enhanced ATT&CK Techniques

Name	Use
Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)	Emotet uses custom packers which first decrypt the loaders, and then the loaders decrypt and load Emotet's main payloads. [2]
Discovery::System Information Discovery (E1082)	Emotet collects information related to OS, processes, and sometimes mail client information and sends it to C2. [2]
Persistence::Registry Run Keys / Startup Folder (F0012)	To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence. [1]
Impact::Clipboard Modification (E1510)	Emotet writes clipboard data. [6]

MBC Behaviors

Name	Use
Anti-Static Analysis::Executable Code Obfuscation::Junk Code Insertion (B0032.007)	Emotet macros are heavily obfuscated with junk functions and string substitutions. [1]
Cryptography::Encrypt Data::RSA (C0027.011)	Emotet uses RSA to encrypt network traffic to its C2. [2]
Discovery::Analysis Tool Discovery::Process detection - Debuggers (B0013.002)	If it receives a response from the C2 server stating a debugging-related tool is in the list of running processes, it receives an "upgrade" command which calls the ShellExecuteW function and exits. [3]
Anti-Behavioral Analysis::Virtual Machine Detection::Guest Process Testing (B0009.010)	Emotet checks for various processes that are associated with various virtual machines by comparing hash values of the process names with the hash values of the list of running process names. [4]
Command and Control::C2 Communication::Request Email Address List (B0030.010)	New email addresses are collected automatically from the victim's address books. [4]
Execution::Send Email (B0020)	Spam email with the Emotet loader is sent automatically. [4]
Communication::HTTP Communication::Create Request (C0002.012)	Emotet creates a HTTP request. [6]
Cryptography::Encrypt Data::RC4 (C0027.009)	Emotet encrypts data using RC4 PRGA. [6]
Discovery::Code Discovery::Enumerate PE Sections (B0046.001)	Emotet enumerates PE sections. [6]