Emotet hosted in Japan 18/Jan/2019

Main object- "DEZ2018"
	sha256	05668fd9ef981bb76d0d65eb3008772586be66450e1f2554f0033c4eb95747ef
	sha1	7d3d0c899ed760577604b4a531d6e494b0071eaa
	md5	bab599bb94f5635171990a4911dc6e6a
Dropped executable file
	sha256	C:\Users\Public\639.exe	6e55912b89e79469f6a0d8e73539998a1b1f9c44a676bcdf67ed167051e6b407
DNS requests
	domain	refinisherstrading.com
Connections
	ip	41.203.18.41
	ip	189.159.119.242
	ip	200.43.114.10
	ip	189.250.100.248
	ip	190.55.123.250
	ip	201.103.81.129
HTTP/HTTPS requests
	url	http://refinisherstrading.com/0ccRGilOI/
	url	http://refinisherstrading.com/0ccRGilOI
	url	http://190.55.123.250/
	url	http://200.43.114.10:8080/
	url	http://189.250.100.248:465/
	url	http://201.103.81.129/
HTTP requests in MalDoc Macro
	http://refinisherstrading.com/0ccRGilOI
	http://www.soloftp.com/EAJTlS0gfg
	http://www.etsybizthai.com/bGiJgZKiUj
	http://curiouseli.com/v601pQKUQ
	http://wp.corelooknung.com/8u7sDim
Configration analysed with Cape Sandbox
	190.146.158.142:993
	190.55.123.250:80
	178.201.186.245:143
	200.43.114.10:8080
	189.159.119.242:22
	201.103.81.129:80
	186.90.155.228:21
	189.250.100.248:465
	186.129.174.150:8080
	189.173.4.161:995
	72.47.248.48:8080
	69.163.33.82:8080
	69.158.10.125:50000
	95.9.248.89:80
	109.104.79.48:8080
	185.38.216.84:80
	24.222.22.58:990
	159.65.76.245:443
	45.73.27.218:80
	31.193.130.187:443
	187.192.133.210:53
	210.2.86.72:8080
	144.76.117.247:8080
	181.54.202.80:443
	201.231.70.72:80
	189.190.40.163:990
	192.155.90.90:7080
	187.137.111.0:21
	23.254.203.51:8080
	190.190.101.38:443
	200.83.21.5:80
	189.163.44.44:143
	116.240.3.27:443
	190.25.255.98:465
	219.94.254.93:8080
	190.226.34.8:21
	216.252.83.23:20
	185.86.148.222:8080
	190.195.169.170:20
	210.19.41.87:50000
	31.53.229.122:8090
	186.190.192.84:143
	92.48.118.27:8080
	165.227.213.173:8080
	49.212.135.76:443
	181.45.45.132:8443
	189.208.126.53:143
	80.12.84.86:8080
	181.167.49.76:80
	200.86.246.50:20
	138.68.139.199:443
	5.9.128.163:8080
	190.245.10.162:143
	201.200.3.74:21
	181.211.11.171:443
	133.242.208.183:8080
	212.81.22.231:143
	79.98.31.206:443
References
	https://app.any.run/tasks/9f75a52b-0f2c-4cc0-9480-4edc172bd977
	https://cape.contextis.com/analysis/30740/