Emotet 14/Feb/2019

Main object- "eBILL_0214201912981.doc"
	sha256	e6b79db99b399198a61b836acb552f49c58e491bebda5dc7125d2a3f8b798f1f
	sha1	dd285a0cdec4e2ed244f4c98f5524febbfe130e9
	md5	e1606adcd91f2aec847f92544baf796d
Dropped executable file
	sha256	C:\Users\admin\84.exe	682b02b1f671242aef2744368015828cb0347f153c142e15da57ae01e3b4594a
DNS requests
	domain	gardenstrutturelegno.com
Connections
	ip	94.23.66.212
	ip	181.167.251.10
HTTP/HTTPS requests
	url	http://gardenstrutturelegno.com/pafgY1kbyB/
	url	http://gardenstrutturelegno.com/pafgY1kbyB
	url	http://181.167.251.10:8080/
HTTP requests wrote in MalDoc Macro
	http://gardenstrutturelegno.com/pafgY1kbyB
	http://mhoment.com/LM20Ymp
	http://extrashades.com/CfK0g0aQ4r
	http://gandharaminerals.com/4J2ko2vsYO
	http://baovevietnamtoancau.com/wp-admin/includes/uZ8bAUa52
Emotet C2 communication analysed(Configration)
682b02b1f671242aef2744368015828cb0347f153c142e15da57ae01e3b4594a
	189.178.109.181:143
	64.40.163.8:143
	181.167.251.10:8080
	51.255.50.164:8080
	192.163.199.254:8080
	23.254.203.51:8080
	72.47.248.48:8080
	69.163.33.82:8080
	74.45.170.110:80
	12.6.183.21:8080
	186.72.205.234:22
	74.62.52.222:20
	186.4.127.72:995
	75.110.229.201:443
	159.65.76.245:443
	92.48.118.27:8080
	190.96.172.225:8090
	219.94.254.93:8080
	185.86.148.222:8080
	189.183.68.180:7080
	210.2.86.72:8080
	189.173.176.115:443
	76.94.36.57:80
	5.9.128.163:8080
	80.15.172.81:50000
	109.104.79.48:8080
	66.209.69.165:443
	192.155.90.90:7080
	90.63.245.70:8080
	201.212.113.14:50000
	165.227.213.173:8080
	187.145.0.129:7080
	190.117.226.104:8080
	98.121.75.14:80
	98.238.127.216:21
	200.116.200.136:8080
	181.15.224.57:80
	190.186.110.202:22
	144.76.117.247:8080
	70.167.72.96:143
	51.77.109.100:80
	138.68.139.199:443
	181.56.165.97:53
	104.200.80.44:20
	24.194.252.25:80
	71.40.213.82:8080
	24.37.161.242:80
References
	https://app.any.run/tasks/cb88a0b0-fd60-4ee8-8015-e5d37321f016
	https://cape.contextis.com/analysis/36965/