evilnum | 0d878b1b9f5c1ae8925e55df9e10b4271eb99970af133e251830044d24296ba8 | Triage

Analysis

max time kernel
147s
max time network
150s
platform
windows10_x64
resource
win10v20201028
submitted
26-12-2020 20:21

Sharing

Report Analysis Logs

General

Target

3b7cd07e87902deae4b482e987dea9e25a93a55ec783884e8b466dc55c346bce.lnk
Size

685KB
MD5

6363ddf8a20345c0201868b209afbd63
SHA1

941727ee9620624f595175468c27f863e3c2bc4a
SHA256

3b7cd07e87902deae4b482e987dea9e25a93a55ec783884e8b466dc55c346bce
SHA512

f885eb46111da748b28b6a78d8e59e8e4f614e66e2e051e7a04d2d857c41513fdf68db77e2ee5319195389d6bd17e08fe5a2b159312e6deff5d157edfe8b2fe4

Score

10^/10

evilnum trojan

Malware Config

Signatures

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 876 wrote to memory of 708	876	cmd.exe	cmd.exe
PID 876 wrote to memory of 708	876	cmd.exe	cmd.exe
PID 708 wrote to memory of 4060	708	cmd.exe	cmd.exe
PID 708 wrote to memory of 4060	708	cmd.exe	cmd.exe
PID 708 wrote to memory of 2880	708	cmd.exe	find.exe
PID 708 wrote to memory of 2880	708	cmd.exe	find.exe
PID 708 wrote to memory of 432	708	cmd.exe	wscript.exe
PID 708 wrote to memory of 432	708	cmd.exe	wscript.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\3b7cd07e87902deae4b482e987dea9e25a93a55ec783884e8b466dc55c346bce.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:876

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&move "compliance-docpack.pdf.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "END2">"C:\Users\Admin\AppData\Local\Temp\0.js"&wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
2⤵
- Suspicious use of WriteProcessMemory
PID:708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
3⤵
PID:4060

C:\Windows\system32\find.exe
find "END2"
3⤵
PID:2880

C:\Windows\system32\wscript.exe
wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
3⤵
PID:432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-5-0x0000000000000000-mapping.dmp

Download
memory/708-2-0x0000000000000000-mapping.dmp

Download
memory/2880-4-0x0000000000000000-mapping.dmp

Download
memory/4060-3-0x0000000000000000-mapping.dmp

Download