evilnum | 0d878b1b9f5c1ae8925e55df9e10b4271eb99970af133e251830044d24296ba8

Analysis

Target

db5d09edc2e9676a41f26f5f4310df9d13abdae8011b1d37af7139008362d5f1.lnk
Size

685KB
MD5

aad36ffbe3fc85f853751f4329a346e9
SHA1

fd443a1f4dfaa6ad38f0581f58ab38a0b0478770
SHA256

db5d09edc2e9676a41f26f5f4310df9d13abdae8011b1d37af7139008362d5f1
SHA512

430d00f4bc9f6fa18bd257d90deca104752c5a45fdcb4e54eb5a8d08de2daab43a205c0fea57da93fea6d444106534311f44c734f7b396c2c7ad53c74d3a11b1

Score

10^/10

evilnum trojan

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 576 1088 cmd.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

940 PING.EXE

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	1088	cmd.exe

pid	process
940	PING.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

cmd.execmd.execmd.exe

description	pid	process	target process
PID 1676 wrote to memory of 1996	1676	cmd.exe	cmd.exe
PID 1676 wrote to memory of 1996	1676	cmd.exe	cmd.exe
PID 1676 wrote to memory of 1996	1676	cmd.exe	cmd.exe
PID 1996 wrote to memory of 1984	1996	cmd.exe	cmd.exe
PID 1996 wrote to memory of 1984	1996	cmd.exe	cmd.exe
PID 1996 wrote to memory of 1984	1996	cmd.exe	cmd.exe
PID 1996 wrote to memory of 1960	1996	cmd.exe	find.exe
PID 1996 wrote to memory of 1960	1996	cmd.exe	find.exe
PID 1996 wrote to memory of 1960	1996	cmd.exe	find.exe
PID 1996 wrote to memory of 580	1996	cmd.exe	wscript.exe
PID 1996 wrote to memory of 580	1996	cmd.exe	wscript.exe
PID 1996 wrote to memory of 580	1996	cmd.exe	wscript.exe
PID 576 wrote to memory of 940	576	cmd.exe	PING.EXE
PID 576 wrote to memory of 940	576	cmd.exe	PING.EXE
PID 576 wrote to memory of 940	576	cmd.exe	PING.EXE

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\db5d09edc2e9676a41f26f5f4310df9d13abdae8011b1d37af7139008362d5f1.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&move "PersonalKYC.pdf.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "END2">"C:\Users\Admin\AppData\Local\Temp\0.js"&wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
2⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
3⤵
PID:1984

C:\Windows\system32\wscript.exe
wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
3⤵
PID:580

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact