The Return of Emotet

OS Credential Dumping: LSASS Memory [T1003.001]

Emotet has been observed dropping password grabber modules including Mimikatz.

Remote Services: SMB/Windows Admin Shares [T1021.002]

Emotet leverages the Admin$ share for lateral movement once the local admin password has been brute forced.

Obfuscated Files or Information [T1027]

Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware, cmd.exe arguments, and PowerShell scripts.

Obfuscated Files or Information: Software Packing [T1027.002]

Emotet has used custom packers to protect its payloads.

Network Sniffing [T1040]

Emotet has been observed to hook network APIs to monitor network traffic.

Exfiltration Over C2 Channel [T1041]

Emotet has been seen exfiltrating system information stored within cookies sent within a HTTP GET request back to its command and control (C2) servers.

Windows Management Instrumentation [T1047]

Emotet has used WMI to execute powershell.exe.

Process Injection: Dynamic-link Library Injection [T1055.001]

Emotet has been observed injecting in to Explorer.exe and other processes.

Process Discovery [T1057]

Emotet has been observed enumerating local processes.

Command and Scripting Interpreter: PowerShell [T1059.001]

Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz.

Command and Scripting Interpreter: Windows Command Shell [T1059.003]

Emotet has used cmd.exe to run a PowerShell script.

Command and Scripting Interpreter: Visual Basic [T1059.005]

Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.

Valid Accounts: Local Accounts [T1078.003]

Emotet can brute force a local admin password, then use it to facilitate lateral movement.

Account Discovery: Email Account [T1087.003]

Emotet has been observed leveraging a module that can scrape email addresses from Outlook.

Brute Force: Password Guessing [T1110.001]

Emotet has been observed using a hard-coded list of passwords to brute force user accounts.

Email Collection: Local Email Collection [T1114.001]

Emotet has been observed leveraging a module that scrapes email data from Outlook.

User Execution: Malicious Link [T1204.001]

Emotet has relied upon users clicking on a malicious link delivered through spearphishing.

User Execution: Malicious File [T1204.002]

Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.

Exploitation of Remote Services [T1210]

Emotet has been seen exploiting SMB via a vulnerability exploit like ETERNALBLUE (MS17-010) to achieve lateral movement and propagation.

Create or Modify System Process: Windows Service [T1543.003]

Emotet has been observed creating new services to maintain persistence.

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1547.001]

Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence.

Scheduled Task/Job: Scheduled Task [T1053.005]

Emotet has maintained persistence through a scheduled task.

Unsecured Credentials: Credentials In Files [T1552.001]

Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user.

Credentials from Password Stores: Credentials from Web Browsers [T1555.003]

Emotet has been observed dropping browser password grabber modules.

Archive Collected Data [T1560]

Emotet has been observed encrypting the data it collects before sending it to the C2 server.

Phishing: Spearphishing Attachment [T1566.001]

Emotet has been delivered by phishing emails containing attachments.

Phishing: Spearphishing Link [T1566.002]

Emotet has been delivered by phishing emails containing links.

Non-Standard Port [T1571]

Emotet has used HTTP over ports such as 20, 22, 7080, and 50000, in addition to using ports commonly associated with HTTP/Hypertext Transfer Protocol Secure.

Encrypted Channel: Asymmetric Cryptography [T1573.002]

Emotet is known to use RSA keys for encrypting C2 traffic.