yunsip | ec5a98f900ddb60a9bbbe0fba1219546c30444228eaa668c476871be57eb7d7a

Analysis

max time kernel
241s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 17:33

Target

ec5a98f900ddb60a9bbbe0fba1219546c30444228eaa668c476871be57eb7d7a.dll
Size

235KB
MD5

3a28003465de3c821f52064addfbc470
SHA1

a9db3396f420bfe6cd5c118ce6eb88c24dc530d7
SHA256

ec5a98f900ddb60a9bbbe0fba1219546c30444228eaa668c476871be57eb7d7a
SHA512

bbca6403cf9c2c7da9675e32348fb4fb00542e2eb4e388ddbedc38314e04cc66e67e7d9e904cdd751ba583137d426fee7fd482ec2ce650cc2609380e03dcb0dc
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0p:jDgtfRQUHPw06MoV2nwTBlhm8x

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1988 wrote to memory of 296	1988	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 296	1988	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 296	1988	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 296	1988	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 296	1988	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 296	1988	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 296	1988	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec5a98f900ddb60a9bbbe0fba1219546c30444228eaa668c476871be57eb7d7a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec5a98f900ddb60a9bbbe0fba1219546c30444228eaa668c476871be57eb7d7a.dll,#1
2⤵
PID:296

memory/296-54-0x0000000000000000-mapping.dmp

Download
memory/296-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download