evilnum | 0d878b1b9f5c1ae8925e55df9e10b4271eb99970af133e251830044d24296ba8

Analysis

Target

3b7cd07e87902deae4b482e987dea9e25a93a55ec783884e8b466dc55c346bce.lnk
Size

685KB
MD5

6363ddf8a20345c0201868b209afbd63
SHA1

941727ee9620624f595175468c27f863e3c2bc4a
SHA256

3b7cd07e87902deae4b482e987dea9e25a93a55ec783884e8b466dc55c346bce
SHA512

f885eb46111da748b28b6a78d8e59e8e4f614e66e2e051e7a04d2d857c41513fdf68db77e2ee5319195389d6bd17e08fe5a2b159312e6deff5d157edfe8b2fe4

Score

10^/10

evilnum trojan

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 832	612	cmd.exe	27
PID 612 wrote to memory of 832	612	cmd.exe	27
PID 612 wrote to memory of 832	612	cmd.exe	27
PID 832 wrote to memory of 1464	832	cmd.exe	28
PID 832 wrote to memory of 1464	832	cmd.exe	28
PID 832 wrote to memory of 1464	832	cmd.exe	28
PID 832 wrote to memory of 1172	832	cmd.exe	29
PID 832 wrote to memory of 1172	832	cmd.exe	29
PID 832 wrote to memory of 1172	832	cmd.exe	29
PID 832 wrote to memory of 1248	832	cmd.exe	30
PID 832 wrote to memory of 1248	832	cmd.exe	30
PID 832 wrote to memory of 1248	832	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\3b7cd07e87902deae4b482e987dea9e25a93a55ec783884e8b466dc55c346bce.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&move "compliance-docpack.pdf.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "END2">"C:\Users\Admin\AppData\Local\Temp\0.js"&wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
    3⤵
    PID:1464
- - C:\Windows\system32\find.exe
    find "END2"
    3⤵
    PID:1172
- - C:\Windows\system32\wscript.exe
    wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
    3⤵
    PID:1248