H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Emotet](https://attack.mitre.org/software/S0367) is a modular malware variant which is primarily used as a downloader for other malware variants such as [TrickBot](https://attack.mitre.org/software/S0266) and [IcedID](https://attack.mitre.org/software/S0483). Emotet first emerged in June 2014, initially targeting the financial sector, and has expanded to multiple verticals over time.(Citation: Trend Micro Banking Malware Jan 2019)

Labels

malware

48 recorded

Relationships

uses

to Binary Padding

Technique

uses

to Command Obfuscation

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Credentials In Files

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Email Account

Technique

uses

to Email Collection

Technique

uses

to Embedded Payloads

Technique

uses

to Encrypted Channel

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exploitation of Remote Services

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Local Accounts

Technique

uses

to Local Email Collection

Technique

uses

to LSASS Memory

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Masquerade Task or Service

Technique

uses

to Native API

Technique

uses

to Network Share Discovery

Technique

uses

to Network Sniffing

Technique

uses

to Non-Standard Port

Technique

uses

to Password Guessing

Technique

uses

to PowerShell

Technique

uses

to Process Discovery

Technique

uses

to Process Hollowing

Technique

uses

to Reflective Code Loading

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Regsvr32

Technique

uses

to Scheduled Task

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to Software Packing

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to Standard Encoding

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Owner/User Discovery

Technique

uses

to Token Impersonation/Theft

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Wi-Fi Discovery

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Service

Technique

uses

from Wizard Spider

Group

16 external

References

mitre-attack

S0367

open

Emotet

—

Geodo

—

Talos Emotet Jan 2019

https://blog.talosintelligence.com/2019/01/return-of-emotet.html

open

CIS Emotet Apr 2017

https://www.cisecurity.org/blog/emotet-changes-ttp-and-arrives-in-united-states/

open

CIS Emotet Dec 2018

https://www.cisecurity.org/white-papers/ms-isac-security-primer-emotet/

open

Red Canary Emotet Feb 2019

https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

open

ESET Emotet Nov 2018

https://www.welivesecurity.com/2018/11/09/emotet-launches-major-new-spam-campaign/

open

Secureworks Emotet Nov 2018

https://www.secureworks.com/blog/lazy-passwords-become-rocket-fuel-for-emotet-smb-spreader

open

Picus Emotet Dec 2018

https://www.picussecurity.com/blog/the-christmas-card-you-never-wanted-a-new-wave-of-emotet-is-back-to-wreak-havoc.html

open

Trend Micro Banking Malware Jan 2019

https://blog.trendmicro.com/trendlabs-security-intelligence/new-banking-malware-uses-network-sniffing-for-data-theft/

open

Kaspersky Emotet Jan 2019

https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/

open

Malwarebytes Emotet Dec 2017

https://support.malwarebytes.com/docs/DOC-2295

open

Symantec Emotet Jul 2018

https://www.symantec.com/blogs/threat-intelligence/evolution-emotet-trojan-distributor

open

Trend Micro Emotet Jan 2019

https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf

open

US-CERT Emotet Jul 2018

https://www.us-cert.gov/ncas/alerts/TA18-201A

open