yunsip | 2e305f5b1f08fcb1567f85aae5d807dbb84c8dad10a1a9dbcf7ef63c08f6ad5d

Analysis

max time kernel
94s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 19:57

Target

2e305f5b1f08fcb1567f85aae5d807dbb84c8dad10a1a9dbcf7ef63c08f6ad5d.dll
Size

711KB
MD5

18e08e3c153114e0034fbfa29f90a690
SHA1

9375feb8666abe731b3fc99195e5823c13512822
SHA256

2e305f5b1f08fcb1567f85aae5d807dbb84c8dad10a1a9dbcf7ef63c08f6ad5d
SHA512

b814bebcbc2664f0100bf219fed7203d4be58700a7b099a30e0018d6a08a50e4da893d726bf1f4ea084a750c224f0be6a4edd98db2a9c4b33ab27a089e12a937
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY0:o6RI1Fo/wT3cJYYYYYYYYYYYY0

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3992 wrote to memory of 4596	3992	rundll32.exe	rundll32.exe
PID 3992 wrote to memory of 4596	3992	rundll32.exe	rundll32.exe
PID 3992 wrote to memory of 4596	3992	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e305f5b1f08fcb1567f85aae5d807dbb84c8dad10a1a9dbcf7ef63c08f6ad5d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e305f5b1f08fcb1567f85aae5d807dbb84c8dad10a1a9dbcf7ef63c08f6ad5d.dll,#1
2⤵
PID:4596