yunsip | 829f64eb9cb838d529a83e6b480fc43f40fd119a582fe02cdd0c992b64318821

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 19:08

Target

0a52a0860a41f884a6e904ebabd3f582_JaffaCakes118.dll
Size

311KB
MD5

0a52a0860a41f884a6e904ebabd3f582
SHA1

7a34df08e8fab7f8f45e5b3ca2c50356f7e29156
SHA256

829f64eb9cb838d529a83e6b480fc43f40fd119a582fe02cdd0c992b64318821
SHA512

c34367b30dd8d5f985fb7f6137acaf8c437eb86802455b9746e27d918dd8e61fead888206755c20eccd45e10d5b3a57a685fdb94bda4fc37eb9443fa94da0f89
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0D:jDgtfRQUHPw06MoV2nwTBlhm87

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2040	3048	rundll32.exe	28
PID 3048 wrote to memory of 2040	3048	rundll32.exe	28
PID 3048 wrote to memory of 2040	3048	rundll32.exe	28
PID 3048 wrote to memory of 2040	3048	rundll32.exe	28
PID 3048 wrote to memory of 2040	3048	rundll32.exe	28
PID 3048 wrote to memory of 2040	3048	rundll32.exe	28
PID 3048 wrote to memory of 2040	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a52a0860a41f884a6e904ebabd3f582_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a52a0860a41f884a6e904ebabd3f582_JaffaCakes118.dll,#1
  2⤵
  PID:2040