DLL hijacking in EmoCheck enables local code execution

TL;DR — A DLL search order flaw in EmoCheck lets an attacker-provided DLL execute with the user’s privileges when the tool is launched from a compromised directory.

What happened

EmoCheck is a Windows tool distributed by JPCERT/CC to help detect infections by the Emotet malware family. Powder Keg Technologies reports it discovered a vulnerability in EmoCheck’s DLL loading behavior and coordinated disclosure via Japan’s vulnerability reporting process, resulting in a public CVE and JVN publication.

The issue is an Uncontrolled Search Path Element (CWE-427) (i.e., DLL hijacking). The JVN description states exploitation is possible by getting a user to place a crafted DLL in the same directory as EmoCheck and then execute the tool, resulting in arbitrary code execution with the invoking user’s privileges.

Even “trusted” defensive utilities can become a reliable execution primitive if they are routinely downloaded, copied between machines, and run from shared folders or email/IM download directories — this is a classic enterprise lateral-movement and initial-execution pattern on Windows.

Who is impacted

• Windows environments where EmoCheck is still present and executed (IR playbooks, IT admin toolkits, or ad-hoc malware triage workflows).
• Users who run EmoCheck from directories where an attacker can plausibly influence adjacent files (e.g., shared drives, extracted zip folders from untrusted sources, Downloads/Desktop staging folders).
• Organizations that keep “portable” security tooling on endpoints without provenance controls (signed distribution validation, controlled locations, and execution restrictions).

What to do now

• Follow vendor guidance from JVN.

  "Stop using EmoCheck"

• Inventory endpoints and admin workstations for EmoCheck binaries and remove them from use.
• Treat systems where EmoCheck was executed from untrusted or user-writable directories as potentially exposed to local code execution:
  • Review process execution telemetry for EmoCheck runs and suspicious DLL loads from the same directory.
  • If there is any sign of tampering, perform incident response appropriate to a user-context execution event (credential review/rotation where applicable, and endpoint triage).
• For future “portable tooling” usage, reduce recurrence risk by standardizing execution from controlled directories and applying Windows execution control policies (e.g., allowlisting) for administrative utilities.