yunsip | 3a9819f4092e85af0dd9e249f6cf8e9a5e8408c10d88e128eeec7cea02d1c0c2

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 01:25

Target
3a9819f4092e85af0dd9e249f6cf8e9a5e8408c10d88e128eeec7cea02d1c0c2.dll
Size 240KB
Sample221029-bs75psfae8
SHA256 3a9819f4092e85af0dd9e249f6cf8e9a5e8408c10d88e128eeec7cea02d1c0c2
MD5 0ca194bd9c793a94a1b9934418b57409
SHA1 9209d4146dfc477287521711ebaff7a769617b38
SHA512 ab41317fe884ea3c6235cbe39cb2e61e79c02f790f493cf6586f736cefe205f054932e9bf62b394d40bb508f7fce17440f75b7cf6c0f2c752d89f4e9f4cd427a
SSDEEP 3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q05:jDgtfRQUHPw06MoV2nwTBlhm8B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 3604	1796	rundll32.exe	81
PID 1796 wrote to memory of 3604	1796	rundll32.exe	81
PID 1796 wrote to memory of 3604	1796	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a9819f4092e85af0dd9e249f6cf8e9a5e8408c10d88e128eeec7cea02d1c0c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a9819f4092e85af0dd9e249f6cf8e9a5e8408c10d88e128eeec7cea02d1c0c2.dll,#1
  2⤵
  PID:3604