4/18 Epoch 2 Payloads with Rebuilt IATs

4/18 Payloads with their IATs rebuilt

Epoch 2:
b24ef93fc2757659cf1af4f36096c71945f702758997b48c9123532242b85d7b - https://www.virustotal.com/#/file/af1412395cfe07419b01278a29dfbb618efcc1e7ca33eeb722c412deaff81ec1
9588692f5a1b07b834c85e7d169d343acc12d04d62ddfb50f82aba8de05ab9c0 - https://www.virustotal.com/#/file/0589ccf0f381f6ab71c726b78b1f4167aff50d045e3eefa02b02205e5f9107c2
6e52728e4855ec0588cbcf92fba3e707b11e576afb31c9306caeb95f97abab63 - https://www.virustotal.com/#/file/81ecdd831a670eebaa90d61c2230aabc2ee9c64b228bedf64028443bd44de310

Update:  Today, Emotet has drastically changed their loader again.  A couple days ago, we saw emotet's distros freeze on a payload for a while.  This was what @JRoosen was calling the slow burner(It takes a bit to show the C2s).  It was a heavily obfuscated loader that functioned relatively the same as the past loaders, with a couple key differences.  The biggest one being (apart from the obvious obfuscation) that it changed how it loads the payload into memory.  Instead of using UnmapViewOFFile and VirtualAlloc,  which @prsecurity_ tweeted about on the 11th, it now locates the ImageBase address by subtracting 0x1000 from [EAX] until the DOS header is located.  It then uses rep stos to clear the base image, and then rep movsd to transfer code over.

Today, we saw a modified version of the slow burner, which we've been calling the slow burner v2.  Its also heavily obfuscated, but functions relatively the same as the slow burner v1.  However, once it finally connects (Took around 1:30), it moves through the IP's much faster than in v1.

Any.Run: https://app.any.run/tasks/ba50328a-07c3-4e15-8247-3a4dc16f6b0e

Additionally, I didn't receive any E1 samples today.