yunsip | 679fcb9463812c1a59797720fbf782de23d20f54bdc428c81f944d45dafe7d93

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:55

Target

679fcb9463812c1a59797720fbf782de23d20f54bdc428c81f944d45dafe7d93.dll
Size

415KB
MD5

653a8bd55403924a859c426ff4b77d70
SHA1

20af63e067dee257783bab7396641a188107193e
SHA256

679fcb9463812c1a59797720fbf782de23d20f54bdc428c81f944d45dafe7d93
SHA512

1a58174b52120673d85876f5e85aee9411029c21bc2cc05c562726e94a6eb10f14bb9f5720e7f5410c50109e5bd9e821a4487050a28b88af4911faf5ba8ab68f
SSDEEP

3072:oDKpt9sSR0HUHPwZWLnWVfEAzV2INwTBftZmc+z+f3Q0e:oDgtfRQUHPw06MoV2swTBlxm8W

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26
PID 1708 wrote to memory of 1944	1708	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\679fcb9463812c1a59797720fbf782de23d20f54bdc428c81f944d45dafe7d93.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\679fcb9463812c1a59797720fbf782de23d20f54bdc428c81f944d45dafe7d93.dll,#1
  2⤵
  PID:1944

memory/1944-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download