yunsip | 991bba0a2f8de384e5f09eace59773a85fb3281f433229656b7649b445dfc03f

Analysis

max time kernel
41s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 22:01

Target

991bba0a2f8de384e5f09eace59773a85fb3281f433229656b7649b445dfc03f.dll
Size

367KB
MD5

0031d095445067acf80dc794b0d9c75e
SHA1

2d94bff05e9fbe1f49ba33af38f076574dca4c1d
SHA256

991bba0a2f8de384e5f09eace59773a85fb3281f433229656b7649b445dfc03f
SHA512

8c16fdee064c030c391523a8adb80bf79a3e9e0cb9fb8e92e000401efd13cf832096ab5930af01f3f672fd7f1205239fde126e4e446db989c01ee236262e0f8c
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0w:jDgtfRQUHPw06MoV2nwTBlhm8I

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 944	1276	rundll32.exe	28
PID 1276 wrote to memory of 944	1276	rundll32.exe	28
PID 1276 wrote to memory of 944	1276	rundll32.exe	28
PID 1276 wrote to memory of 944	1276	rundll32.exe	28
PID 1276 wrote to memory of 944	1276	rundll32.exe	28
PID 1276 wrote to memory of 944	1276	rundll32.exe	28
PID 1276 wrote to memory of 944	1276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\991bba0a2f8de384e5f09eace59773a85fb3281f433229656b7649b445dfc03f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\991bba0a2f8de384e5f09eace59773a85fb3281f433229656b7649b445dfc03f.dll,#1
  2⤵
  PID:944

memory/944-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download