yunsip | 1f5957e2e21b128ec9650ec19624faf9a7a1806e10bf73696c124a0d1595493c

Analysis

max time kernel
126s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 19:24

Target

1f5957e2e21b128ec9650ec19624faf9a7a1806e10bf73696c124a0d1595493c.dll
Size

617KB
MD5

9c93cb21c373dd9da9e67165ba8a7b8e
SHA1

d8ee8fc3ad4f275f0538120c0efc9b8c9d678a6e
SHA256

1f5957e2e21b128ec9650ec19624faf9a7a1806e10bf73696c124a0d1595493c
SHA512

552568598ac78ef3757031ec1c9f7c5b579a1b19428a2f7c1248cf229de6af35552ad5044f0cc541b74b7a7c7ea1c07ae24cafdd94793053c18c35832d5e901a
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYR:o6RI1Fo/wT3cJYYYYYYYYYYYYR

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 1672	4604	rundll32.exe	88
PID 4604 wrote to memory of 1672	4604	rundll32.exe	88
PID 4604 wrote to memory of 1672	4604	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f5957e2e21b128ec9650ec19624faf9a7a1806e10bf73696c124a0d1595493c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f5957e2e21b128ec9650ec19624faf9a7a1806e10bf73696c124a0d1595493c.dll,#1
  2⤵
  PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3988,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
1⤵
PID:5116