Emotet

Emotet has the ability to duplicate the user’s token.^[3]

Emotet has been observed leveraging a module that can scrape email addresses from Outlook.^[4][5][3]

Emotet has used HTTP for command and control.^[3]

Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence.^[7][8][9]

Emotet has been observed using a hard coded list of passwords to brute force user accounts. ^{[10][7][8][11][4][3]}

Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz. ^{[7][2][9][12][13]}

Emotet has been observed creating new services to maintain persistence.^[8][11][3]

Emotet has been observed dropping browser password grabber modules. ^[2][5]

Emotet has used Google’s Protobufs to serialize data sent to and from the C2 server.^[3]

Emotet is known to use RSA keys for encrypting C2 traffic. ^[2]

Emotet has installed itself as a new service with the service name Windows Defender System Service and display name WinDefService.^[3]

Emotet has used custom packers to protect its payloads.^[2]

Emotet has been observed dropping password grabber modules including Mimikatz. ^[2]

Emotet has been delivered by phishing emails containing attachments. ^{[16][10][7][8][14][2][9][13][5]}

Emotet has been observed injecting in to Explorer.exe and other processes. ^[9][1][8]

Emotet has leveraged the Admin$, C$, and IPC$ shares for lateral movement. ^[10][3]

Emotet has maintained persistence through a scheduled task. ^[8]

Emotet can extract names of all locally reachable Wi-Fi networks and then perform a brute-force attack to spread to new networks.^[3]

Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user. ^[8][4]

Emotet has relied upon users clicking on a malicious link delivered through spearphishing.^[1][13]

Emotet can brute force a local admin password, then use it to facilitate lateral movement.^[10]