#Emotet’s operators were busy updating their systeminfo module, with changes that enable malware operators to improve the targeting of specific victims and distinguish tracking bots from real users. #ESETresearch 1/7
The operators completely changed the attributes that are collected and sent to the attacker’s C&Cs. The new list includes processor brand, size of physical memory in MB and an approximate % of it being in use. 2/7 
The magic number – used by the server to verify that the systeminfo module is up to date – is obtained in a different way too. Instead of being part of the main function, 64 functions are used, with the module selecting one that returns the correct value. 3/7
The “correct” magic number function is selected by computing modulo 64 from a module checksum – a value obtained from the C&C server – posing a tougher challenge for reverse engineers. 4/7
The updated module uses a reworked “communicate” function, replacing API functions from wininet.dll with those from winhttp.dll. A new WinAPI CreateTimerQueueTimer is used, setting the time for the callback function – managing the upload and download of data – to be called. 5/7
This is the first #Emotet update after 3 months of inactivity, and aims to make analysis more difficult and evade detection. The changes in harvested info and the magic number enable them to improve targeting of specific victims and distinguish tracking bots from real users. 6/7
Systeminfo module IoCs*
c064677fb33d77ff9a38f94bf401c7b66dfede2c
5801e65365b62db47ed363ab21e4650ad80aa0a3
9ca421815eb04cc0ebefb23ff9445b04709a144d
7c5c76e1a873958af2ce4952d1154c9b6b317ef7
decb6c053c186538510805bdb377610fbbd66037
*Emotet uses hashbusting
7/7
c064677fb33d77ff9a38f94bf401c7b66dfede2c
5801e65365b62db47ed363ab21e4650ad80aa0a3
9ca421815eb04cc0ebefb23ff9445b04709a144d
7c5c76e1a873958af2ce4952d1154c9b6b317ef7
decb6c053c186538510805bdb377610fbbd66037
*Emotet uses hashbusting
7/7
• • •
Missing some Tweet in this thread? You can try to
force a refresh
