Extracted

• • Target

    emotet_e2_b0b540ad237698caeabe4f0eb6faa0869a39484393d922cd298e23b304562845_2021-01-21__010744949463._fpx

  • Size

    167KB

  • MD5

    a95ee0c5063aee700c215411ddd0ad70

  • SHA1

    d1f874cae13df91fbdb1545d4cb243629c742c2c

  • SHA256

    b0b540ad237698caeabe4f0eb6faa0869a39484393d922cd298e23b304562845

  • SHA512

    5fdb1e1d5f31b72d09de1cdacc0378a68d95950b46b5cb9dd1e3046c898f3c4b2e04113b3ba116a94f1165a068c37b3ae17380b28a56a80a264a6987f2bbe72a

  Score

  10^/10

  ransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  behavioral1