Emotet began as a banking trojan in 2014 and has since evolved into a modular loader used to hand off follow-on payloads for other criminal groups, including operators behind Trickbot and Ryuk. It spreads mainly through phishing documents and malicious links, and it has repeatedly resurfaced after law-enforcement takedowns with retooled evasion techniques.
A researcher recently reverse-engineered a post-takedown Emotet sample end-to-end: the initial script dropper, the fileless in-memory payload, its anti-analysis tricks, and its encrypted command-and-control channel. This lab walks through the key stages of that analysis. Read each briefing panel carefully — the quiz below tests whether you understand why each technique works, not just that it exists.
Click a stage to reveal the key findings the analysis recorded at that point in the chain.
Select a stage above to see its findings.
| Tactic | Technique | ID |
|---|---|---|
| Execution | Command and Scripting Interpreter: Visual Basic | T1059.005 |
| Defense Evasion | Reflective Code Loading | T1620 |
| Defense Evasion | Obfuscated Files or Information: Dynamic API Resolution | T1027.007 |
| Defense Evasion | Subvert Trust Controls: Mark-of-the-Web Bypass | T1553.005 |
| Defense Evasion | Indicator Removal: File Deletion | T1070.004 |
| Command & Control | Encrypted Channel: Asymmetric Cryptography | T1573.002 |
Because the payload is fileless and every API call is hash-resolved, the researcher notes that detection has to lean on behavior: rundll32.exe running a DLL from %AppData% with the export Control_RunDLL; a script host writing a .txt file to %temp% and immediately executing it as a script; Zone.Identifier deletion right after a copy into %AppData%; a process deleting every file in its own directory; and the specific API sequence BCryptGenerateKeyPair → BCryptSecretAgreement → BCryptDeriveKey followed by wininet traffic carrying a large base64 blob in a randomly named cookie.
Select one answer per question, then click "Check Answer." You get up to two attempts per question; answer order is randomized each time the page loads. Your running score updates below. Complete all four to unlock the completion step.
Once all four questions are checked, fill in your name and click "Finalize Lab" to generate your completion record. Print or screenshot this page to submit as your assignment record, per your instructor's instructions.