Extracted

• • Target

    emotet_e2_4ba19977d7051012b6f22a72868e1c909438f6eca3e725dde0816c11f5d7f262_2021-01-21__002013549246._fpx

  • Size

    164KB

  • MD5

    9fd577ef5be9b1fea11778c35a441b99

  • SHA1

    241c8bd8a9a8954115c54f7a5db2492a9d1a6054

  • SHA256

    4ba19977d7051012b6f22a72868e1c909438f6eca3e725dde0816c11f5d7f262

  • SHA512

    4fe576dc4a7e0b83d07b1075d253b2bfcc78af19aceeba3cee676d992f6965d7c58dc06d05c91b08748ffb284e935c28cebaa01a43fdadf1572f8cf81454826b

  Score

  10^/10

  ransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  behavioral1