yunsip | 0f3381b97a0744b00df9a9858c7a465a195043ec25c99be33d6365f67d64acf3

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 22:05

Target

0f3381b97a0744b00df9a9858c7a465a195043ec25c99be33d6365f67d64acf3.dll
Size

392KB
MD5

478df6ec6436b2db864c4a81817b3e20
SHA1

aff7a6bdb7ab0b3ef3fc8506cff404d6f5fbe229
SHA256

0f3381b97a0744b00df9a9858c7a465a195043ec25c99be33d6365f67d64acf3
SHA512

684a93f278b7609265b2f044413e267181f219ef98735160a7deb1725fbd67f02adcbf3ee8f5d9dd1979c3f929a1c00d81f146d249bdf8bd3deb3a90a58edd4a
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0s:jDgtfRQUHPw06MoV2nwTBlhm8U

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 916	1848	rundll32.exe	28
PID 1848 wrote to memory of 916	1848	rundll32.exe	28
PID 1848 wrote to memory of 916	1848	rundll32.exe	28
PID 1848 wrote to memory of 916	1848	rundll32.exe	28
PID 1848 wrote to memory of 916	1848	rundll32.exe	28
PID 1848 wrote to memory of 916	1848	rundll32.exe	28
PID 1848 wrote to memory of 916	1848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f3381b97a0744b00df9a9858c7a465a195043ec25c99be33d6365f67d64acf3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f3381b97a0744b00df9a9858c7a465a195043ec25c99be33d6365f67d64acf3.dll,#1
  2⤵
  PID:916

memory/916-55-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download