Emotet Being Distributed via OneNote

AhnLab Security Emergency response Center (ASEC) has recently discovered the distribution of Emotet being distributed via OneNote. A spear phishing email as below attached with a OneNote file prompts the reader to open the attachment which contains a malicious script file (JS file).

Upon running the OneNote file, it directs the user to click the button to connect to the cloud to open the document. This ‘Next’ button is inserted with a malicious script named output1.js.

As shown below, the executed output1.js file is obfuscated via string substitution. The script file that is ultimately executed connects to the designated C2 and downloads Emotet.

The downloaded Emotet is executed through regsvr32.exe. As there have been frequent reports of malware distribution exploiting OneNote, users must be cautious when opening emails or OneNote files from unknown sources.

[Detection]

• Malware/Win.Generic.C5398625 (2023.03.22.02)
• Downloader/JS.Agent (2023.03.24.00)
• Dropper/MSOffice.Generic (2023.03.24.00)

Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP. For subscription details, click the banner below.