Extracted

• • Target

    emotet_e2_58087e36eb939fe42f9ecafa00c3ba4002c238182b406a45db0ffa7ae6e83398_2021-01-21__004406271513._fpx

  • Size

    165KB

  • MD5

    203c21854f83f1aa654e763bb362b1e7

  • SHA1

    f092e71c7d9b0c24d80b1f9bcf6a86680dfb3c5d

  • SHA256

    58087e36eb939fe42f9ecafa00c3ba4002c238182b406a45db0ffa7ae6e83398

  • SHA512

    03f57c75ee6c3f9698c64ffa1e7fd1f41badf61ca61b33d0972137d84f53b18b736c0e0c5eb5a5f797c4ebc5362e155ab804681554e8f9b09a7bda3fa804de2c

  Score

  10^/10

  ransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  behavioral1