yunsip | 535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 08:45

Target

535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6.dll
Size

306KB
MD5

bd8ff93293061314386b884627c40780
SHA1

2892b838949f160adf5f20b992a8a52bdf45a221
SHA256

535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6
SHA512

4af1acdb61e6bea91c388fa407e37b7139492ce1207d6248cc9cd04e9f6dcb711a15a7af04dade1da58e70353033365581cef28348c1d5fdb3d87d74c8688431
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0u:jDgtfRQUHPw06MoV2nwTBlhm8m

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6.dll,#1
  2⤵
  PID:1568

memory/1568-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download