yunsip | 600454d176a9c5159cd189600a0b72a71f1a747a5b9f54d0f1088ede7d3702b1

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 15:06

Target

600454d176a9c5159cd189600a0b72a71f1a747a5b9f54d0f1088ede7d3702b1.dll
Size

610KB
MD5

0d2d41a2355f3d27ca14b6f8fd6ba130
SHA1

2cf40a7b5505b1666b007bcac6ca1f7d75a10755
SHA256

600454d176a9c5159cd189600a0b72a71f1a747a5b9f54d0f1088ede7d3702b1
SHA512

f9fafc67f4f5e7d779775da8c9eb86f8aa76f40a6c2b3c1cdb53128fa7ff7908cba6c529521664cc8ef00bf643acfcf6b6f7f4fd6534214069b16de5aff6be9f
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q04:jDgtfRQUHPw06MoV2nwTBlhm8g

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\600454d176a9c5159cd189600a0b72a71f1a747a5b9f54d0f1088ede7d3702b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\600454d176a9c5159cd189600a0b72a71f1a747a5b9f54d0f1088ede7d3702b1.dll,#1
  2⤵
  PID:2032

memory/2032-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download