Extracted

• • Target

    emotet_e2_11e1780e215a952185315253632033b1e42e269f59252e80ccc002e7ed15c086_2021-01-21__050818692746._fpx

  • Size

    164KB

  • MD5

    ae295ee7ee45cac846113d5495869afc

  • SHA1

    c4c5b81939476c89a2925c0080491ed9f5e65113

  • SHA256

    11e1780e215a952185315253632033b1e42e269f59252e80ccc002e7ed15c086

  • SHA512

    8d046fab7c7f07027751f91e2299fa0ea09ff036753ddde31d2f38ac56596a408d9f353aada94967a57025bb32a2e3456cf828bc96e94e9edb1baa0e1247c2b1

  Score

  10^/10

  ransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  behavioral1