Emotet IoC 02092020

Main object- "mensaje-2020-0937.doc"
	sha256	a71c558f8283e417740916d49509d5d6c5c43d1592f58337d758a9cf85b01936
	sha1	2e0953d5aab9367d2b14a09b5f89e1fb177f6caf
	md5	bb5623db4413a78e79e7d3f1f431bffa

DNS requests
	domain	fortcollinsathletefactory.com

Connections
	ip	173.247.249.97

	http://fortcollinsathletefactory.com/wp-admin/i/
	http://getming.com/forum/p/
	http://gaffa-music.com/cgi-bin/UM/
	http://frankfurtelfarolillo.com/laseu/c7/
	http://evilnerd.org/cgi-bin/nUi/
	http://gapesmm.org/old/M/
	http://grml.net/wp/C/

------------------------------

Main object- "Datos_9366765.doc"
	sha256	be5c91824e588031f8b4250a5aed0b1029ded29d5666ebdbe231a25c99d17e56
	sha1	a672b5370cd651dbc7ea51a65f20abb40ad90578
	md5	e2d14696288eb5496b1869b4614ed483

Dropped executable file
	sha256	C:\Users\admin\AppData\Local\shadow\wdc.exe	20dce632067d189b586fe9f5ceb48ba1bf9ad98ad95955487787f4cfcb01e676

DNS requests
	domain	www.luxurygt.com
	domain	mmxiv.org
	domain	niokolo.com

Connections
	ip	217.76.132.167
	ip	81.169.145.82
	ip	192.99.242.156
	ip	50.121.220.50

HTTP/HTTPS requests
	url	http://mmxiv.org/wp-snapshots/hwC/
	url	http://50.121.220.50/h5lkaubqItklIklMTD/
	url	http://niokolo.com/0-Accueil_ALBUMS/ua/

http://www.luxurygt.com/wordpress/a73/
http://mmxiv.org/wp-snapshots/hwC/
http://niokolo.com/0-Accueil_ALBUMS/ua/
http://greiser.net/Ebay/m/
http://gnadl.net/cgi-bin/cD/
http://grabner-online.org/Bibelkonverter/GCH/
http://goldschmiedemeister.net/bilder/9/

------------------------------

Main object- "Datos_02.doc"
	sha256	a71c558f8283e417740916d49509d5d6c5c43d1592f58337d758a9cf85b01936
	sha1	2e0953d5aab9367d2b14a09b5f89e1fb177f6caf
	md5	bb5623db4413a78e79e7d3f1f431bffa

Dropped executable file
	sha256	C:\Users\admin\AppData\Local\nslookup\colorui.exe	fd7653d428853db8e8f85e815340d5a82082cdd304a23ce5862662cc56b4435d

DNS requests
	domain	fortcollinsathletefactory.com
	domain	getming.com
	domain	gaffa-music.com

Connections
	ip	173.247.249.97
	ip	81.169.145.164
	ip	185.2.4.22

http://fortcollinsathletefactory.com/wp-admin/i/
http://getming.com/forum/p/
http://gaffa-music.com/cgi-bin/UM/
http://frankfurtelfarolillo.com/laseu/c7/
http://evilnerd.org/cgi-bin/nUi/
http://gapesmm.org/old/M/
http://grml.net/wp/C/