yunsip | 52879f479b5546b60279ab57af340ab6958c1be8e29322f63053739f904575e9

Analysis

max time kernel
2s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 08:46

Target

52879f479b5546b60279ab57af340ab6958c1be8e29322f63053739f904575e9.dll
Size

350KB
MD5

7bba422886739593c2fd2848d9f0e4b8
SHA1

3c1ec51d54836f59630cea5db3c7c4f79e140eac
SHA256

52879f479b5546b60279ab57af340ab6958c1be8e29322f63053739f904575e9
SHA512

8695db885b615e59c1705accfaf7e091248b28eb15cd108fbe297da46e0c9e3ef1ca447a6e2c5d220a53ef3f005165b2f195e23101a3bb8bf9f87ac6b1ce9038
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0m:jDgtfRQUHPw06MoV2nwTBlhm8e

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\52879f479b5546b60279ab57af340ab6958c1be8e29322f63053739f904575e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\52879f479b5546b60279ab57af340ab6958c1be8e29322f63053739f904575e9.dll,#1
  2⤵
  PID:972

memory/972-55-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download