yunsip | 3227a2cbe990558b96e933eaae08b8ba9315d3fb3ef5320088f11b83df083911

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 08:46

Target

3227a2cbe990558b96e933eaae08b8ba9315d3fb3ef5320088f11b83df083911.dll
Size

420KB
MD5

b9b7489ac8174fe770906be9c6347850
SHA1

29993674da90eb2a5118cb76ada98b43b9ed304c
SHA256

3227a2cbe990558b96e933eaae08b8ba9315d3fb3ef5320088f11b83df083911
SHA512

aea854aceb293e8674edc53d2a1dcf914f1c0027d61446934abb0ee3abf8a7e5061275a649ac0e69266e35812cdd5b85658266013feaa3b677aa37ad27098f0b
SSDEEP

3072:IDKpt9sSR0HUHPwZWLnWVfEAzV2IMwTBftZmc+z+f3Q0u:IDgtfRQUHPw06MoV2dwTBlxm8m

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26
PID 1416 wrote to memory of 1292	1416	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3227a2cbe990558b96e933eaae08b8ba9315d3fb3ef5320088f11b83df083911.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3227a2cbe990558b96e933eaae08b8ba9315d3fb3ef5320088f11b83df083911.dll,#1
  2⤵
  PID:1292

memory/1292-55-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download