This one is pretty advanced.
Infection method: malicious script, macro-enabled document files, or malicious link.
Cloaking: familiar branding designed to look like a legitimate e-mail.
Persuade mode: key words like “Your Invoice”, “Payment Details”, "Upcoming Shipment".
Anti-countermeasures: detects if it’s running inside a virtual machine (VM) - will standby if it detects a sandbox environment. Emotet is a polymorphic Trojan that can evade typical signature-based detection. It has several methods for maintaining persistence, including auto-start registry keys and services. It uses modular Dynamic Link Libraries (DLLs) to continuously evolve and update its capabilities.
Update method: C&C servers, just like "Windows update" works. Updates allow additional malware installation (this is the current version) usually focused on banking Trojans, or convert itself into a system that assimilates stolen information such as financial credentials, usernames/passwords, and e-mail addresses, after which it sends them away.
Other capabilities: it can take advantage of the Windows Eternal Blue Vulnerability, starts various keep-alive services named as random numbers.
If you suspect an infection, isolate the system from the network immediately and run a deep scan with advanced anti-malware tools like Kaspersky or Malwarebytes. An alternate method is to restart in safe mode and perform a complete system restore and then scan your system with Reimage.
Other things that should be done is secure the e-mail part better and train users not to click/open everything they receive and report suspicious e-mails.