yunsip | 2bdeebe6cadedd10f1ac707d4425bc9ab9b9e219d0f245b8dcfd225f0fe51b58

Analysis

max time kernel
10s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:56

Target

2bdeebe6cadedd10f1ac707d4425bc9ab9b9e219d0f245b8dcfd225f0fe51b58.dll
Size

231KB
MD5

b60a45636dd232c1ff52489115eb2800
SHA1

49b23a60eb99eb9070208339c20df9320b8c035c
SHA256

2bdeebe6cadedd10f1ac707d4425bc9ab9b9e219d0f245b8dcfd225f0fe51b58
SHA512

99153ab1329d1aec935bf8bd4762f114e94814f96f8dfc84eb71c775909ffc4e8d4703b36b0af2aec2d7473ce7104d8153096714a8b3c6f8063e8a95bd668871
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0+:jDgtfRQUHPw06MoV2nwTBlhm8G

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 1484	1780	rundll32.exe	28
PID 1780 wrote to memory of 1484	1780	rundll32.exe	28
PID 1780 wrote to memory of 1484	1780	rundll32.exe	28
PID 1780 wrote to memory of 1484	1780	rundll32.exe	28
PID 1780 wrote to memory of 1484	1780	rundll32.exe	28
PID 1780 wrote to memory of 1484	1780	rundll32.exe	28
PID 1780 wrote to memory of 1484	1780	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bdeebe6cadedd10f1ac707d4425bc9ab9b9e219d0f245b8dcfd225f0fe51b58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bdeebe6cadedd10f1ac707d4425bc9ab9b9e219d0f245b8dcfd225f0fe51b58.dll,#1
  2⤵
  PID:1484

memory/1484-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download