Extracted

• • Target

    emotet_e2_80f688c0b9fb7d3277bddc7d43c06d13ddb6a1658247870d0287de8c157e0bec_2021-01-21__043011726170._fpx

  • Size

    164KB

  • MD5

    48632e62a3844f54e01ba4461da82fe5

  • SHA1

    858bf16240255cc635ac5b5860804997357c2f31

  • SHA256

    80f688c0b9fb7d3277bddc7d43c06d13ddb6a1658247870d0287de8c157e0bec

  • SHA512

    47a2eb160f11526270b2d502b241a228270718e48ba9cac0da3eb18ef05e2ead8ce9613774fce63af3c864de9ed308c3a4c461dbfa1800cd595f829945c67af0

  Score

  10^/10

  ransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  behavioral1