yunsip | a1c1a9f671c0bed854367179ab5d828fb4b1e33534ee66918254bc2790cb795b

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-11-2022 08:56

Target

a1c1a9f671c0bed854367179ab5d828fb4b1e33534ee66918254bc2790cb795b.dll
Size

225KB
MD5

27115461429b64375169874b3957a9e8
SHA1

01d15f3c2927d757f9c2ee36d83f6896fef9a7ee
SHA256

a1c1a9f671c0bed854367179ab5d828fb4b1e33534ee66918254bc2790cb795b
SHA512

139472c057ad84e0b1cf2df370e96ea983e1c247a89c370e26439e785eecbe3329c9ffe64c8105148a20d941277ec5da2b81fa3eab35b00f3b46bedb26f51423
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q03:jDgtfRQUHPw06MoV2nwTBlhm8v

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1c1a9f671c0bed854367179ab5d828fb4b1e33534ee66918254bc2790cb795b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1c1a9f671c0bed854367179ab5d828fb4b1e33534ee66918254bc2790cb795b.dll,#1
  2⤵
  PID:1340

memory/1340-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download