Extracted

• • Target

    emotet_e2_fef516c40db60794e220e323bd96e2a26f5808d97ac911e2bd4afc4b0cd756bc_2021-01-21__042344958362._fpx

  • Size

    164KB

  • MD5

    408f71b781f4676a19fe1fc3b7c50589

  • SHA1

    2d4274b874ab4f41b5fb7b6791bd724e68c52bca

  • SHA256

    fef516c40db60794e220e323bd96e2a26f5808d97ac911e2bd4afc4b0cd756bc

  • SHA512

    e78b45e082ff0c0c45a2fe39719872a3749d83010eb734e144fe7c70fc29d1f61c00732db4f37a07291b710bd0c2e99a9f69808728f9bbd918a6a4d00ccaf4a5

  Score

  10^/10

  ransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  behavioral1