Extracted

• • Target

    emotet_e2_4cadad6fe9f001e7d45a39b6a54af137aa2cc08f465010ecb7539156ed88d384_2021-01-20__233031247901._fpx

  • Size

    164KB

  • MD5

    3ad96dd517e993d8a893cf4404c57bdb

  • SHA1

    7cd637d17057e07007bdf5f5c541c8ca95dca4d1

  • SHA256

    4cadad6fe9f001e7d45a39b6a54af137aa2cc08f465010ecb7539156ed88d384

  • SHA512

    859a033e69d477ad112c8043e23739a287a00c7103072943db499f1c1bd9391ae98a22e1e2d91e84346134abc6c432174857bfc54c2f591ff848c4e9f5864893

  Score

  10^/10

  ransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  behavioral1