The Anatomy of Emotet Network Traffic without Wireshark Filters

Emotet, a notorious information-stealing malware, has been wreaking havoc on computer systems since its first reported appearance in 2014 as banking malware. Its ability to adapt and evolve over time has made it a persistent threat to networks worldwide. In this tutorial, we'll delve into the network traffic caused by Emotet without relying on Wireshark filters, providing security professionals with valuable insights into identifying this malware through traffic analysis.

The Critical Step: Microsoft Word Document Macros

Emotet's infection chain begins with a malicious Microsoft Word document containing macros designed to infect vulnerable Windows hosts. This is often accomplished through the distribution of malspam emails. To fully comprehend the network traffic generated by Emotet, it's essential to understand the sequence of events leading to an infection.

A Non-Windows Environment: The Safe Choice

When analyzing packet captures (pcaps) related to Emotet infections, we recommend reviewing them in a non-Windows environment such as BSD, Linux, or macOS. This precautionary measure helps prevent any potential risk of infection if using a Windows computer. Be advised that some of the pcaps used for this tutorial contain Windows-based malware.

Accessing the GitHub Repository

To follow along with this tutorial, you'll need to access a GitHub repository containing ZIP archives with the pcaps used for analysis. These instructions assume that you have customized your Wireshark setup as described in our previous tutorial on customizing column displays.

Evolution of Emotet: From Banking Malware to Dropper

Since its inception, Emotet has undergone significant transformations, adding new features and functionalities to its repertoire. In addition to its initial role as an information-stealer, it now also serves as a dropper, distributing other malware families such as Gootkit, IcedID, Qakbot, and Trickbot.

Familiarity with Wireshark: A Prerequisite

To fully comprehend the analysis presented in this tutorial, you should have a solid understanding of Wireshark version 3.x. Familiarity with the tool is necessary to identify Emotet's network traffic patterns and behavior without relying on filters.

In conclusion, this tutorial provides security professionals with a comprehensive overview of Emotet's network traffic, highlighting the importance of understanding the infection chain and analyzing pcaps in a non-Windows environment. By mastering these skills, you'll be better equipped to identify and combat Emotet infections in your organization.

Sans wireshark filters