yunsip | b40e4c9c0aae01a3a73a296cb1737848484e98930bc4d03662990165c6429a9f

Analysis

max time kernel
28s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:51

Target

b40e4c9c0aae01a3a73a296cb1737848484e98930bc4d03662990165c6429a9f.dll
Size

232KB
MD5

19e14a95db39dcc4e1f6c64cf0cfc540
SHA1

cd57648c1659fc465b2ed6d9d74afb10ef790f80
SHA256

b40e4c9c0aae01a3a73a296cb1737848484e98930bc4d03662990165c6429a9f
SHA512

58bf35b1edf22729f362bfa17b796a7aff706ebf7497d56bcfaedf062cd8685afcdcd49a62ce8fe39a8f7db4acdf5e1cfcb9d9359b784747b264cb18ebd1c6f7
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0x:jDgtfRQUHPw06MoV2nwTBlhm85

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2008	2012	rundll32.exe	28
PID 2012 wrote to memory of 2008	2012	rundll32.exe	28
PID 2012 wrote to memory of 2008	2012	rundll32.exe	28
PID 2012 wrote to memory of 2008	2012	rundll32.exe	28
PID 2012 wrote to memory of 2008	2012	rundll32.exe	28
PID 2012 wrote to memory of 2008	2012	rundll32.exe	28
PID 2012 wrote to memory of 2008	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b40e4c9c0aae01a3a73a296cb1737848484e98930bc4d03662990165c6429a9f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b40e4c9c0aae01a3a73a296cb1737848484e98930bc4d03662990165c6429a9f.dll,#1
  2⤵
  PID:2008

memory/2008-55-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download