yunsip | 2b1a3a31c14d78f10ba011a0cf31c5bfbf719bcc441ed498fb3f0ea4007b25be

Analysis

max time kernel
4s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 04:31

Target

2b1a3a31c14d78f10ba011a0cf31c5bfbf719bcc441ed498fb3f0ea4007b25be.dll
Size

527KB
MD5

068fa0fe4f1de47119695cbaa53e6c80
SHA1

ff6cea62bacaa2208669b8f0c388e9949e1d5c86
SHA256

2b1a3a31c14d78f10ba011a0cf31c5bfbf719bcc441ed498fb3f0ea4007b25be
SHA512

4dfc446d5bb7c405cfcd56c32e4125676ca32973e2ca37afa8b087b7702fbfb6d41d948f48b0a899d62e220e8a5046bd7e8b1856917d158e58a0f5507fe312f9
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDf:o6C5AXbMn7UI1FoV2gwTBlrIckP1

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1696	1736	rundll32.exe	27
PID 1736 wrote to memory of 1696	1736	rundll32.exe	27
PID 1736 wrote to memory of 1696	1736	rundll32.exe	27
PID 1736 wrote to memory of 1696	1736	rundll32.exe	27
PID 1736 wrote to memory of 1696	1736	rundll32.exe	27
PID 1736 wrote to memory of 1696	1736	rundll32.exe	27
PID 1736 wrote to memory of 1696	1736	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b1a3a31c14d78f10ba011a0cf31c5bfbf719bcc441ed498fb3f0ea4007b25be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b1a3a31c14d78f10ba011a0cf31c5bfbf719bcc441ed498fb3f0ea4007b25be.dll,#1
  2⤵
  PID:1696

memory/1696-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download