yunsip | bf88bc7c73bfc7ecd62b2b0e03233da48569268ffbee5fbd4cbbe0f4cf44e7c1

Analysis

max time kernel
33s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 21:59

Target

bf88bc7c73bfc7ecd62b2b0e03233da48569268ffbee5fbd4cbbe0f4cf44e7c1.dll
Size

346KB
MD5

5fafc528becaaf8b3413bf79434d3884
SHA1

1c91f5f3ca1eb0d927e6658009abdf718ce6bdbc
SHA256

bf88bc7c73bfc7ecd62b2b0e03233da48569268ffbee5fbd4cbbe0f4cf44e7c1
SHA512

8b8d4eee6ee30fef0405975bc7fc1f0b44a9b1da3e3edf74971b733f516bd704dbd60bf0886e9ecec0ff925bc853e25ab1eb80b7f3be46362840415bc16149c9
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0z:jDgtfRQUHPw06MoV2nwTBlhm8b

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1092	1856	rundll32.exe	27
PID 1856 wrote to memory of 1092	1856	rundll32.exe	27
PID 1856 wrote to memory of 1092	1856	rundll32.exe	27
PID 1856 wrote to memory of 1092	1856	rundll32.exe	27
PID 1856 wrote to memory of 1092	1856	rundll32.exe	27
PID 1856 wrote to memory of 1092	1856	rundll32.exe	27
PID 1856 wrote to memory of 1092	1856	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf88bc7c73bfc7ecd62b2b0e03233da48569268ffbee5fbd4cbbe0f4cf44e7c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf88bc7c73bfc7ecd62b2b0e03233da48569268ffbee5fbd4cbbe0f4cf44e7c1.dll,#1
  2⤵
  PID:1092

memory/1092-55-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download