yunsip | 2c60bd1356194c5d505fa408265b75bc1f501057b1f74ce445317b981a9280e0

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-11-2022 08:56

Target

2c60bd1356194c5d505fa408265b75bc1f501057b1f74ce445317b981a9280e0.dll
Size

239KB
MD5

07055f944d0504adfdd49c314dce0b78
SHA1

75e4a6d05f1a4830857c1502ea5548beab6f7882
SHA256

2c60bd1356194c5d505fa408265b75bc1f501057b1f74ce445317b981a9280e0
SHA512

410e4f5cfab3ccd941eb94b74dbff43ff76ab7f3a12880b7ca50fcb89d564c1cf48631a540ea70bcaf8042072333d93685eb2c3cd032e24b153697ac9c8fcd81
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0G:jDgtfRQUHPw06MoV2nwTBlhm8u

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c60bd1356194c5d505fa408265b75bc1f501057b1f74ce445317b981a9280e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c60bd1356194c5d505fa408265b75bc1f501057b1f74ce445317b981a9280e0.dll,#1
  2⤵
  PID:1388

memory/1388-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download