EMOTET 07/17/20

EMOTET IOCs 7/17/2020
*********************

File Writes
************
C:\Users\*\443.exe
SHA256:d98afd6226cb90745c221619a054e12e621d21cf71822cd48ddac8cc4b8971ba

%AppData%\Local\concrt140d\drt.exe
SHA256:d98afd6226cb90745c221619a054e12e621d21cf71822cd48ddac8cc4b8971ba

%AppData%\Local\apphelp\SndVolSSO.exe
SHA256:26e2c8c80e13296907d806937365c11dbd934911e624793f30040af1be441d46

%AppData%Local\AdaptiveCards\mfc120esn.exe
SHA256:f04388ca778ec86e83bf41aa6bfa1b163f42e916d0fbab7e50eaadc8b47caa50

%AppData%Local\iexpress\netcorehc.exe
SHA256:ec41eecc9c02b6d00f80f6f5b06efeb5225a14505e34873dfb83ffa57cd401e0

%AppData%Local\iexpress\ncobjapi7ab.exe
SHA256:69e964fce741677f2509081e52ba72d1555e13fa3047e4db90b7e775c0c8b87a


Registry Persistence
********************
Persistence via Reg Key
HKCU\\Software\Microsoft\Windows\CurrentVersion\Run

Value
*****
C:\Users\Holmes\AppData\Local\AdaptiveCards\mfc120esn.exe
C:\Users\Holmes\AppData\Local\iexpress\netcorehc.exe
C:\Users\Holmes\AppData\Local\concrt140d\drt.exe
C:\Users\Holmes\AppData\Local\apphelp\SndVolSSO.exe



DNS IOCs
*************
-elseelektrikci[.]com
-rviradeals[.]com
-skenglish[.]com
-packersmoversmohali[.]com
-tri-comma[.]com