Extracted

• • Target
    emotet_e1_c4f0553f4860b6f798a83de21e10bc1872e2fd89b8d60a71d59b0e6f4b9ebfaa_2020-10-28__145216569945._fpx
  • Size 266KB
  • SHA256 c4f0553f4860b6f798a83de21e10bc1872e2fd89b8d60a71d59b0e6f4b9ebfaa
  • MD5 0497140868542e8b8cdb6bc8e869ba4c
  • SHA1 931895fcc712e7fe1528f4612e307af6a6654739
  • SHA512 55199a84854d06892e4a6f9af527bbbdf420e47f051b2d898e01a2c952d518a9821030dd6ae7732a57d4f7914666537b3e5993f7607c7ffcbb786bc7d347e588
  • MD5 SHA1 SHA512

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1behavioral2