yunsip | ac663c1dccf3868c4a2e3ee6bc16c3c5dd351c9abbb93313f45f5ef51154d862

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 11:06

Target

ac663c1dccf3868c4a2e3ee6bc16c3c5dd351c9abbb93313f45f5ef51154d862.dll
Size

508KB
MD5

ca75f031ad969647c232eca59552b0c0
SHA1

5dad46c24b47e53e313f22d3b874aed432df9eb3
SHA256

ac663c1dccf3868c4a2e3ee6bc16c3c5dd351c9abbb93313f45f5ef51154d862
SHA512

69433de8471bd10944e8421d1c5c18da8f9bf7c58f704ced18b3a20cfac076893d5d69985edbc5d24e23cb09d8b461ea288d2826f4fd0248306fdd351ab812e7
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q01:jDgtfRQUHPw06MoV2nwTBlhm89

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2916 wrote to memory of 2860	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2860	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2860	2916	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac663c1dccf3868c4a2e3ee6bc16c3c5dd351c9abbb93313f45f5ef51154d862.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac663c1dccf3868c4a2e3ee6bc16c3c5dd351c9abbb93313f45f5ef51154d862.dll,#1
2⤵
PID:2860