Emotet Revival: Triage the November Loader

A back-office workstation at Ashcroft Logistics tripped the SIEM this morning with an Office process spawning a system utility, followed by encrypted traffic to addresses nobody recognizes. Before you pull threads, get oriented: this case starts in a mailbox and ends on the perimeter. Review the available surfaces and the incident window, then begin working the delivery.

The trail begins with one inbound message that slipped past authentication and carried a macro-enabled attachment dressed up as a reply in an existing thread. Establish who sent it.

Opening the attachment and enabling content did not just render a spreadsheet. The macro launched a trusted Windows utility that has no business being a child of an Office application. Identify the utility the macro used to register and run the dropped payload.

The utility did not carry the payload itself. It reached out to a website to retrieve a loader library. The host is a legitimate business site that was compromised, so the dangerous artifact is the full path it pulled, not the bare domain. Recover the URL it downloaded the loader from.

Once the loader ran, it began beaconing over encrypted web traffic to a rotating set of external addresses. To contain the host you need the address it talked to most. Identify the primary command-and-control endpoint, as an address and port.

Hours after the first beacon, a second outbound channel opened to a different external host, launched by a separate system binary. That is the hands-on second-stage beacon. Identify the command-and-control domain it contacted.

For the incident report, classify how the attacker proxied execution of the loader through a trusted, signed Windows binary instead of running it directly. Map that evasive behavior to its MITRE ATT&CK technique.