yunsip | 8b6b2e0fbab2fdd19e087f7e77e72a7922181918783cab7433938294d7e178f9

Analysis

max time kernel
153s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 02:46

Target
8b6b2e0fbab2fdd19e087f7e77e72a7922181918783cab7433938294d7e178f9.dll
Size 278KB
Sample221202-c9jn4sfb48
SHA256 8b6b2e0fbab2fdd19e087f7e77e72a7922181918783cab7433938294d7e178f9
MD5 5cf06264cd21d7fd0fa51b6d5f1ab92d
SHA1 8c63ecac22cb69ad560b8188d445603ef3e6e85b
SHA512 46817310439677b1bd98a57143b59eacfe541e01ea0b16b93ec381e4c0a2e47e05344ff291fd255b2062b1d9389d52348f596689e7c1a14410aac918d0fb33d1
SSDEEP 3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0B:jDgtfRQUHPw06MoV2nwTBlhm8Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 2688	4112	rundll32.exe	78
PID 4112 wrote to memory of 2688	4112	rundll32.exe	78
PID 4112 wrote to memory of 2688	4112	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b6b2e0fbab2fdd19e087f7e77e72a7922181918783cab7433938294d7e178f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b6b2e0fbab2fdd19e087f7e77e72a7922181918783cab7433938294d7e178f9.dll,#1
  2⤵
  PID:2688