Emotet Downloader Document Uses Regsvr32 for Execution

Executive Summary

This paper investigates a recent Emotet intrusion and details how the final Emotet payload is installed onto the system. The key observations are:

• Obfuscated Excel macros used to download and run the Emotet loader.


• Emotet loader executed using regsvr32.exe.


• Encrypted Emotet payload embedded in loader’s .rsrc section.


• Windows service used for Emotet payload persistence.


• Emotet continues to evolve delivery techniques and obfuscation to reduce detection.

Background

Emotet is a Windows-based malware loader operated by the cybercrime group TA542 …

cybercriminal document emotet intelligence research malware mitre attack regsvr32 technical threats and vulnerabilities threats & breaches trojan vulnerabilities