Extracted

• • Target
    emotet_e1_3a42d565cc18af8b48926bccb2b06179f7e6210c0e2cfe4e313c2bb86f81e682_2020-10-28__145217253261._fpx
  • Size 265KB
  • SHA256 3a42d565cc18af8b48926bccb2b06179f7e6210c0e2cfe4e313c2bb86f81e682
  • MD5 b04a0f00f5c8c50fb0844c8b2f4de33d
  • SHA1 ce74836e4879ec52d4bbca66c6391b299c630735
  • SHA512 d645c4f0721e31a046266c1fa5e2f05456424b348d50642fe1afcaec66b4cb7e4ff150e65729ab10c0532af7c0e59c6fc18674e6edd6a012733ac14a8f379394
  • MD5 SHA1 SHA512

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1behavioral2