dashboardmodule-10
HIGHEmotet / TrickBot
Interactive simulation and visual analysis of the attack vector.
01Malicious Delivery (Macro)
Emotet is typically delivered via phishing emails containing macro-enabled Word documents. When a user is tricked into 'Enabling Content', a hidden VBScript spawns PowerShell.
INVOICE_89432.doc [Protected View] - Word
SECURITY WARNING Macros have been disabled.
DOCUMENT PROTECTED BY RSA SECURE ID
Click "Enable Content" to decrypt and view this document.
Click "Enable Content" to decrypt and view this document.
02Fileless API Execution
The PowerShell script reaches out to the internet, downloads the encrypted TrickBot payload, allocates memory using VirtualAlloc(), and executes it directly in RAM, leaving no footprint on the hard drive.
WIN32 API MONITOR // powershell.exe (PID: 9021)
SYSTEM MEMORY MAP (RAM)
0x00400000 [RESERVED]
0x00410000 [RESERVED]
0x00420000 [RESERVED]
0x00430000 [RESERVED]
0x00440000 [RESERVED]
1. URLDownloadToFileA()
Fetching encrypted payload from compromised WordPress site.
URL: http://vintage-cars-blog.net/wp-content/uploads/payload.bin
URL: http://vintage-cars-blog.net/wp-content/uploads/payload.bin
2. VirtualAlloc()
Allocating contiguous memory block in RAM.
Protection: PAGE_EXECUTE_READWRITE (RWX)
Protection: PAGE_EXECUTE_READWRITE (RWX)
3. CreateThread()
Executing the decrypted TrickBot payload entirely in memory (fileless).
Status: MALWARE RUNNING
Status: MALWARE RUNNING
03C2 Beaconing
Once active, the malware encrypts host data and begins 'beaconing'—sending regular outbound HTTP/HTTPS requests to external Command and Control (C2) servers to receive further instructions.
NETWORK TRAFFIC