Extracted

• • Target

    emotet_e2_8d7efeeb6526c1ce01dd7d5a75a5f9c22d9ef5dec9e19d6504cc1d073cf8c864_2021-01-21__041359208017._fpx

  • Size

    164KB

  • MD5

    d0bfe9e775b2b81a0b9bb2251fb53ce5

  • SHA1

    f47d747018049fb9270f4be6001a0db91a030039

  • SHA256

    8d7efeeb6526c1ce01dd7d5a75a5f9c22d9ef5dec9e19d6504cc1d073cf8c864

  • SHA512

    aa406babb5418f789f417ad9072a96bd91135d9446866648cbfd47f8e94badfbc8fa86c24a26dd208e8a8eb10a7bfbf1a3824772220398437acf4e89c982e874

  Score

  10^/10

  ransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  behavioral1