Always Look a Gift (Trojan) Horse In the Mouth w/James Arndt | CypherCon 4.0

### Overview In this presentation at CypherCon 4.0, James Arndt walks through practical techniques for dissecting malicious documents used to distribute Emotet malware. Highlighting the common scenario of phishing emails that prompt users to enable content in Microsoft Office documents, Arndt demonstrates how analysts can extract valuable indicators of compromise (IOCs) at every stage of the infection lifecycle—from the initial email delivery and macro execution to subsequent executable drops and command-and-control (C2) communication.

### Key Topics - **Email and Initial Stage Triage**: Extracting early indicators including sender addresses, subjects, originating IP addresses, download URLs, and file hashes before opening documents. - **Macro Extraction and Deobfuscation**: Dissecting malicious VBA macros and handling obfuscated code (e.g., base64 encoding, string reversals, character slicing, custom delimiters). - **Process Interception and Emulation**: Using tools to capture command-line arguments and spawned child processes without executing payloads on live production networks. - **Behavioral Analysis of Binaries**: Tracking process creation, registry modifications, memory strings, and outbound network traffic generated by dropped executables. - **Online Sandboxing vs. Manual Analysis**: Balancing automated multi-stage sandbox tools against manual analysis to avoid missing IOCs.

### Technical Details Arndt demonstrates using tools like `OfficeMalScanner` and Didier Stevens' `oledump.py` to extract VBA streams from documents (including XML files disguised as `.doc`). Once extracted, the macros reveal techniques such as `Auto_Open` routines invoking WMI (`win32_process`) to launch PowerShell with encoded payloads (`powershell -e`). Analysts can bypass executing malicious macros directly by utilizing emulation tools like `ViperMonkey`, or by using process monitoring tools like Kahu Security's `Command Watcher`, `Process Spawn Control`, or `Process Hacker` to intercept command-line strings when content is enabled in an isolated analysis VM.

To decode the obfuscated PowerShell commands, Arndt leverages CyberChef with operations such as `From Base64`, `Remove null bytes`, `Find / Replace`, and `Raw Inflate` (to decompress deflate streams). This decodes PowerShell code deploying `Net.WebClient` to cycle through multiple download URLs (typically five compromised sites) and drop an executable (such as `872.exe`) into the user profile. Arndt notes various alternative evasion techniques Emotet employs, such as reversing strings, array-based index slicing, and JavaScript-based obfuscation.

Once the binary is acquired, PE analysis tools like `PE-Studio` help inspect hashes and the Import Address Table (IAT). For runtime behavioral analysis, Arndt employs `RegShot` for registry diffs, `Process Hacker`, `Process Monitor` (visualized via `ProcDOT`), and `Wireshark` for capturing C2 beaconing. During execution, `872.exe` copies itself, launches a child process (`eapmutagen.exe`), and terminates the original parent process while establishing persistence via the `Run` registry key. Furthermore, execution in interactive sandboxes like `ANY.RUN` illustrates post-infection payloads such as TrickBot attempting to disable Windows Defender. Arndt also references `CAPE` sandbox (leveraging research by d00rt) for extracting Emotet's RSA public keys and C2 configuration directly.

### Takeaways - Always perform malware analysis inside dedicated, isolated virtual machines disconnected from corporate networks. - Relying solely on dynamic online sandboxes can lead to incomplete intelligence; for example, a sandbox might only record the single URL successfully contacted, missing the additional fallback download URLs present in the macro script. - Combining manual static script decoding (e.g., in CyberChef) with behavioral tools provides comprehensive IOC coverage, including email headers, staging URLs, dropped file paths, registry persistence keys, and C2 IPs.