Extracted

• • Target

    emotet_e2_2d75bc655ee87200243a8c0f383323e49eb31a7b0cc6f86e4376c41f83e0f542_2021-01-21__030840336641._fpx

  • Size

    165KB

  • MD5

    a1134bb8459b01c04c1868446160bc5d

  • SHA1

    9b02a754ae26b338c58d01b7d96a27f2c006b59b

  • SHA256

    2d75bc655ee87200243a8c0f383323e49eb31a7b0cc6f86e4376c41f83e0f542

  • SHA512

    db5d148a1a9d1d1807b4e4ad4ee51a04e4bc805d53ee8a5c643efbb284dbbee996b040090a05a7d1b0418cf84bc39d7ae6ffdccb3230ccf9bbf4265fb12d477a

  Score

  10^/10

  ransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  behavioral1