2019-09-25 Emotet IOCs


ANALYST NOTES
Today was another day of relatively heavy Emotet volume.
Despite heavier volume, I only saw 18 unique Word document file hashes and 4 unique payload exe files.
Upon executing the Emotet executable, the task that shows up in Task Manager is still "lumberhash.exe*32".
Immediately after running the Emotet executable, a file named 210.exe was noted in the %USERPROFILE% folder.
It was deleted before I could grab it - it seems to move, rename and execute itself as lumberhash.exe.
I can't confirm that until I can grab a file hash from 210.exe.
Again, I was unable to trigger any follow-up malware after infecting my lab VM.
The Emotet VBA macros that I saw continue to use simple base64 with no other significant obfuscation.
I saw both "re-used" email threads and new stand-alone emails today.

CyberChef decodes the base64 and splits out the URLs with this recipe:
From_Base64('A-Za-z0-9+/=',true)
Decode_text('UTF16LE (1200)')
Split('@','\\n')
Extract_URLs(false)

(it does leave a single quote artifact at the very end)


SENDERS OBSERVED
5507@shellpl.pl
adriana.limon@insigniaconsultores.com.mx
aiza.vercide@airyougotravels.com
anhhai@fdtrans.com.vn
ann@artform-inc.com
anne@debels.com
archanamary.l@facapital.co.in
asistentelogistica@larosanautica.com
asni@ngdepot.com.my
bakery@alafiyagroup.com
bochieng@trackntrace.co.ke
buzon.cotizaciones@onlinebct.com
Chaitanya.Kumavat@tikona.co.in
collections.tata@tibos.in
contabilidad@madeinecuador.ec
cruzmurillo@promedan.net
daveclingan@clingansteel.com
descansazul@descansazul.com
direcciocornella@asproseat.org
eotieno@trackntrace.co.ke
f.garavelli@puntodincontro.org
faidzyal.hassan@transfame.com.my
gaston@onlinebct.com
geraldine@tana.admvalue.com
glaeubiger@meinschuldennotruf.de
gretchen.aytin@microtelgsi.com
hardeep@deal4loans.com
hcmf@vinastone.com
helen@qtech.com.hk
hr@choksisoftsolutions.com
info@lavcevic.hr
ipb@kde.my
janet@etech.com.my
JuneManns-Everett@warrencountync.gov
leadreturn@reutersproemail.com
linda.montiel@facturatech.co
mages@hil.com.my
maintenance@getforengineering.com
marketing@cityneon.com.ph
mosaraf@triangleservicesltd.com
nancy@agds.org.ar
nathan@dispatchtcm.com
norazidah@epoca.com.my
paqui@jdolera.com
pchau@supportservices.cl
rahayu@holiks-smg.com
rajendra.sharma@shivamcement.com
ritta-makwangwala@srwb.mw
sales@signworld.co.ls
standerton@thomastyres.co.za
steven@hzncars.com.my
sumeera.shahzad@avicenna.edu.pk
tahiry@tana.admvalue.com
tenking@sozialwerk.de
trinajhoy.abila@bms.com.ph
v.musa@optimaenergyresources.com
wang@takakoh.co.jp
yogesh.k@e-solutioninc.com
zubair@amjaad.com

WORD DOCUMENT FILE HASHES
09f833c73b43fda771b2fbbaef593b50
446ed43cdf01e64b6189724d24e57a39
4ac3895fccda01e186985dd6d59171da
5acf5e8eb4351b89ddd8fb440fa50803
725aeabed9f1acb535e1df312a9aed88
74ea178d380dec1ccf97e9725cde39cd
775924b01762f68757142e0792d987fe
913cf5a3e9f68fb0149c95252d21ff58
9f4442fd3c117f2622df3d9ebb4b1588
b3295925396e1ee37f04e96b3735c2bd
bc5bc82280ecd23ff9800fe8fe862509
c389564bb30686b02a6fcae2f009ca10
c47976efd146b9f2afb58b7f2191d60b
cbd2197f9d7c6b4ba767d3bc3fe9b98f
da6e17c8a10b936f157c462cdf711976
de598cbc76b0d384383e69b7e20e43f0
f4e7837fa1156881054bf54a2d912705
f859739e3b12c2373f2e11dedf38004f

PAYLOAD FILE HASHES
fa95ae3d79fd7b00906201a1087ef29e
f66c59a54de4227b09c1f90e48ab0eb9
8bcb0ce8bb4616184e3f1eee51be6612
284fe79685a92ad19d607e5466c5d810

EMOTET PAYLOAD URLs
http://arbuzios-com-br.umbler.net/wp-admin/zZPfqaDo/
http://beaueffects.com/wp-content/k12yqks_dmed0mt29g-7268777/
http://dev.novembit.com/rattlers-html/pklrbPf/
http://dev5.kenyaweb.com/elite/o4ju8awm-l34z9jn6-7107704/
http://dospk.com/sites/TpsMVEnGJN/
http://drukkombucha.com/wp-content/5k8-c8yeh6z6x4-577398645/
http://fastestlaundry.com/laundry/QMrYZqfYE/
http://freispieler.org/wp-includes/sfg-auz-74362/
http://hepsihediyelik.net/wp-admin/7l8ob60/
http://mti.shipindia.com/wp-admin/css/me1ml_2b9tq9zvd-95185817/
http://ngoinhadaquy.com/wp-admin/20s8zvjwxw_bowi8z96-87/
http://nissandongha.com/wp-content/KNzBUjpb/
http://www.averybit.com/wp-content/uploads/d4/
http://www.vivekanandadegreecollege.com/wp-includes/j63213/
http://zimahenergy.com/wp-content/azwk6/
https://divakurutemizleme.com/wp-content/p4481/
https://iantronik.com/wp-content/NadMOUjUx/
https://rubycuve.com/uqsf/qsKVkhUlri/
https://www.projetorotamusical.com.br/wp-content/oog71_cwzb6zsnn-20060/
https://xuongren.com/wp-content/j2ls7i8sd_bu2xvbns-01849/

EMOTET C2s
http://101.187.237.217:20
http://104.131.11.150:8080
http://104.236.246.93:8080
http://105.186.87.144
http://119.15.153.237
http://136.243.177.26:8080
http://138.201.140.110:8080
http://142.44.162.209:8080
http://144.139.247.220
http://149.167.86.174:990
http://149.202.153.252:8080
http://159.65.25.128:8080
http://162.144.47.94:7080
http://169.239.182.217:8080
http://173.212.203.26:8080
http://177.246.193.139:20
http://178.254.6.27:7080
http://178.79.161.166:443
http://179.32.19.219:22
http://181.143.194.138:443
http://182.176.106.43:995
http://182.176.132.213:8090
http://182.76.6.2:8080
http://185.142.236.163:443
http://185.94.252.13:443
http://186.4.172.5:443
http://186.4.172.5:8080
http://186.75.241.230
http://187.144.189.58:50000
http://188.166.253.46:8080
http://189.209.217.49
http://190.106.97.230:443
http://190.145.67.134:8090
http://190.18.146.70
http://190.186.203.55
http://190.201.164.223:53
http://190.211.207.11:443
http://190.228.72.244:53
http://200.21.90.6
http://200.71.148.138:8080
http://201.251.43.69:8080
http://206.189.98.125:8080
http://211.63.71.72:8080
http://212.129.24.82:8080
http://212.71.234.16:8080
http://217.145.83.44
http://217.160.182.191:8080
http://222.214.218.192:8080
http://31.12.67.62:7080
http://31.172.240.91:8080
http://37.157.194.134:443
http://41.220.119.246
http://45.123.3.54:443
http://45.33.49.124:443
http://46.105.131.87
http://47.41.213.2:22
http://5.196.74.210:8080
http://62.75.187.192:8080
http://63.142.253.122:8080
http://77.237.248.136:8080
http://78.24.219.147:8080
http://80.11.163.139:443
http://83.136.245.190:8080
http://85.104.59.244:20
http://85.106.1.166:50000
http://86.98.25.30:53
http://87.106.136.232:8080
http://87.106.139.101:8080
http://87.230.19.21:8080
http://88.247.163.44
http://91.205.215.66:8080
http://91.92.191.134:8080
http://92.222.125.16:7080
http://92.222.216.44:8080
http://94.205.247.10
http://95.128.43.213:8080