yunsip | 154b7293ac8597b361dead3f3f2444a0685284123cf6c8933bbe98a2302a09d9

Analysis

max time kernel
23s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 12:17

Target

154b7293ac8597b361dead3f3f2444a0685284123cf6c8933bbe98a2302a09d9.dll
Size

404KB
MD5

de9e05f0c5eb65a406574d94ef317500
SHA1

c7d4b7df75a3acc1c01b0a2c44eb9455df31d975
SHA256

154b7293ac8597b361dead3f3f2444a0685284123cf6c8933bbe98a2302a09d9
SHA512

14a6b11c7a22a1282a23b9d699b0f079ba55a49ff3efa5f9f9394a04c179c4ebbdea01f764ba851df22b00ea2da8cddf9ed446b37976d585331c984f2305f38d
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY1:o6RI1Fo/wT3cJYYYYYYYYYYYY1

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1160	748	rundll32.exe	28
PID 748 wrote to memory of 1160	748	rundll32.exe	28
PID 748 wrote to memory of 1160	748	rundll32.exe	28
PID 748 wrote to memory of 1160	748	rundll32.exe	28
PID 748 wrote to memory of 1160	748	rundll32.exe	28
PID 748 wrote to memory of 1160	748	rundll32.exe	28
PID 748 wrote to memory of 1160	748	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\154b7293ac8597b361dead3f3f2444a0685284123cf6c8933bbe98a2302a09d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\154b7293ac8597b361dead3f3f2444a0685284123cf6c8933bbe98a2302a09d9.dll,#1
  2⤵
  PID:1160

memory/1160-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download