yunsip | 829f64eb9cb838d529a83e6b480fc43f40fd119a582fe02cdd0c992b64318821

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 19:08

Target

0a52a0860a41f884a6e904ebabd3f582_JaffaCakes118.dll
Size

311KB
MD5

0a52a0860a41f884a6e904ebabd3f582
SHA1

7a34df08e8fab7f8f45e5b3ca2c50356f7e29156
SHA256

829f64eb9cb838d529a83e6b480fc43f40fd119a582fe02cdd0c992b64318821
SHA512

c34367b30dd8d5f985fb7f6137acaf8c437eb86802455b9746e27d918dd8e61fead888206755c20eccd45e10d5b3a57a685fdb94bda4fc37eb9443fa94da0f89
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0D:jDgtfRQUHPw06MoV2nwTBlhm87

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2460 wrote to memory of 4444	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 4444	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 4444	2460	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a52a0860a41f884a6e904ebabd3f582_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a52a0860a41f884a6e904ebabd3f582_JaffaCakes118.dll,#1
  2⤵
  PID:4444