Procedure examples

Emotet has been observed dropping and executing password grabber modules including Mimikatz.

Emotet can extract names of all locally reachable Wi-Fi networks and then perform a brute-force attack to spread to new networks.

Emotet has leveraged the Admin$, C$, and IPC$ shares for lateral movement.

Emotet inflates malicious files and malware as an evasion technique.

Emotet has used custom packers to protect its payloads.

Emotet has dropped an embedded executable at `%Temp%\setup.exe`. Additionally, Emotet may embed entire code into other files.

Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware, CMD.exe arguments, and PowerShell scripts.

Emotet uses obfuscated URLs to download a ZIP file.

Emotet has enumerated all users connected to network shares.

Emotet has installed itself as a new service with the service name `Windows Defender System Service` and display name `WinDefService`.

Emotet has been observed to hook network APIs to monitor network traffic.

Emotet has exfiltrated data over its C2 channel.

Emotet has used WMI to execute powershell.exe.

Emotet has maintained persistence through a scheduled task, e.g. though a .dll file in the Registry.

Emotet has been observed injecting in to Explorer.exe and other processes.

Emotet uses a copy of `certutil.exe` stored in a temporary directory for process hollowing, starting the program in a suspended state before loading malicious code.

Emotet has been observed enumerating local processes.

Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz.

Emotet has used cmd.exe to run a PowerShell script.

Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.

Emotet has used HTTP for command and control.

Emotet can brute force a local admin password, then use it to facilitate lateral movement.

Emotet has been observed leveraging a module that can scrape email addresses from Outlook.

Emotet can download follow-on payloads and items via malicious `url` parameters in obfuscated PowerShell code.

Emotet has used `CreateProcess` to create a new process to run its executable and `WNetEnumResourceW` to enumerate non-hidden shares.

Emotet has been observed using a hard coded list of passwords to brute force user accounts.

Emotet has been observed leveraging a module that can scrape email addresses from Outlook.

Emotet has been observed leveraging a module that scrapes email data from Outlook.

Emotet has used Google’s Protobufs to serialize data sent to and from the C2 server. Additionally, Emotet has used Base64 to encode data before sending to the C2 server.

Emotet has the ability to duplicate the user’s token. For example, Emotet may use a variant of Google’s ProtoBuf to send messages that specify how code will be executed.

Emotet has enumerated non-hidden network shares using `WNetEnumResourceW`.

Emotet has used a self-extracting RAR file to deliver modules to victims. Emotet has also extracted embedded executables from files using hard-coded buffer offsets.

Emotet has relied upon users clicking on a malicious link delivered through spearphishing.

Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.

Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue (MS17-010) to achieve lateral movement and propagation.

Emotet uses RegSvr32 to execute the DLL payload.

Emotet has been observed creating new services to maintain persistence.

Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence.

Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user.

Emotet has been observed dropping browser password grabber modules.

Emotet has been delivered by phishing emails containing attachments.

Emotet has been delivered by phishing emails containing links.

Emotet has copied itself to remote systems using the `service.exe` filename.

Emotet has used HTTP over ports such as 20, 22, 443, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.

Emotet has encrypted data before sending to the C2 server.

Emotet is known to use RSA keys for encrypting C2 traffic.

Emotet has reflectively loaded payloads into memory.