yunsip | 2c082620052e23103d132577370649b78999baf14c2e700fc2b15fd97392528e

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:56

Target

2c082620052e23103d132577370649b78999baf14c2e700fc2b15fd97392528e.dll
Size

458KB
MD5

67a104ae93cf65d9842626f328193170
SHA1

ce7caad9161fffa99694e2b855a914df1fdb87c9
SHA256

2c082620052e23103d132577370649b78999baf14c2e700fc2b15fd97392528e
SHA512

7e0764896bc7d3f06677705604efd8aa06e76264ba710e3cb8e8e6a0594aed108276aaecfba86182ce33af63b08b52dce6d1c0a00835e2575277f4f3b683f660
SSDEEP

3072:oDKpt9sSR0HUHPwZWLnWVfEAzV2INwTBftZmc+z+f3Q02:oDgtfRQUHPw06MoV2swTBlxm8O

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe
PID 996 wrote to memory of 956	996	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c082620052e23103d132577370649b78999baf14c2e700fc2b15fd97392528e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c082620052e23103d132577370649b78999baf14c2e700fc2b15fd97392528e.dll,#1
2⤵
PID:956

memory/956-54-0x0000000000000000-mapping.dmp

Download
memory/956-55-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download