yunsip | b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86

Analysis

max time kernel
5s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 08:42

Target

b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86.dll
Size

271KB
MD5

b11328b8bbf06706a96a084f9b23061e
SHA1

69ba62c0abd65a895ea5992bde51fee6b6d15824
SHA256

b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86
SHA512

f9dc0d3e0d6d1dcfb776b4745e885819241121ce9ac7425a7ae89011e94be052b975798f7c0a334558e3c3293d746c6103b9a219ed1fdb4e007097b53d4e70b9
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0C:jDgtfRQUHPw06MoV2nwTBlhm8q

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 948	1216	rundll32.exe	28
PID 1216 wrote to memory of 948	1216	rundll32.exe	28
PID 1216 wrote to memory of 948	1216	rundll32.exe	28
PID 1216 wrote to memory of 948	1216	rundll32.exe	28
PID 1216 wrote to memory of 948	1216	rundll32.exe	28
PID 1216 wrote to memory of 948	1216	rundll32.exe	28
PID 1216 wrote to memory of 948	1216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86.dll,#1
  2⤵
  PID:948

memory/948-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download