yunsip | eb88917e52ae6922dd11b4c6189287bcb91f7bfde2934ab3f644fb310f00aef7

Analysis

max time kernel
82s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 21:58

Target

eb88917e52ae6922dd11b4c6189287bcb91f7bfde2934ab3f644fb310f00aef7.dll
Size

402KB
MD5

36345723f99a622748ec45cdf4da2590
SHA1

37ec1fe39dd2818c0192b90ebf0e3461af9d6400
SHA256

eb88917e52ae6922dd11b4c6189287bcb91f7bfde2934ab3f644fb310f00aef7
SHA512

9d0d0b522ebd004d125d4629610639fa48aaedd27b702ae11d3109a5f6429611b293d9f654712380062bda7221f5327a37c3035449d6be11c63b723d2ec8c401
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0R:jDgtfRQUHPw06MoV2nwTBlhm8Z

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1400	2028	rundll32.exe	28
PID 2028 wrote to memory of 1400	2028	rundll32.exe	28
PID 2028 wrote to memory of 1400	2028	rundll32.exe	28
PID 2028 wrote to memory of 1400	2028	rundll32.exe	28
PID 2028 wrote to memory of 1400	2028	rundll32.exe	28
PID 2028 wrote to memory of 1400	2028	rundll32.exe	28
PID 2028 wrote to memory of 1400	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb88917e52ae6922dd11b4c6189287bcb91f7bfde2934ab3f644fb310f00aef7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb88917e52ae6922dd11b4c6189287bcb91f7bfde2934ab3f644fb310f00aef7.dll,#1
  2⤵
  PID:1400

memory/1400-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download