yunsip | 2bdeebe6cadedd10f1ac707d4425bc9ab9b9e219d0f245b8dcfd225f0fe51b58

Analysis

max time kernel
284s
max time network
334s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 12:56

Target

2bdeebe6cadedd10f1ac707d4425bc9ab9b9e219d0f245b8dcfd225f0fe51b58.dll
Size

231KB
MD5

b60a45636dd232c1ff52489115eb2800
SHA1

49b23a60eb99eb9070208339c20df9320b8c035c
SHA256

2bdeebe6cadedd10f1ac707d4425bc9ab9b9e219d0f245b8dcfd225f0fe51b58
SHA512

99153ab1329d1aec935bf8bd4762f114e94814f96f8dfc84eb71c775909ffc4e8d4703b36b0af2aec2d7473ce7104d8153096714a8b3c6f8063e8a95bd668871
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0+:jDgtfRQUHPw06MoV2nwTBlhm8G

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3424 wrote to memory of 1484	3424	rundll32.exe	rundll32.exe
PID 3424 wrote to memory of 1484	3424	rundll32.exe	rundll32.exe
PID 3424 wrote to memory of 1484	3424	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bdeebe6cadedd10f1ac707d4425bc9ab9b9e219d0f245b8dcfd225f0fe51b58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bdeebe6cadedd10f1ac707d4425bc9ab9b9e219d0f245b8dcfd225f0fe51b58.dll,#1
2⤵
PID:1484