yunsip | b14c631bb141292307746e97ca436e67296d8af3c9f5f0adf8433d8d86eeec7e

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 01:15

Target

26a6c059d30b49795a76472987b2e0a0.dll
Size

744KB
MD5

26a6c059d30b49795a76472987b2e0a0
SHA1

d20d2716917562fa7bc9fa3eec0800ae5519b896
SHA256

b14c631bb141292307746e97ca436e67296d8af3c9f5f0adf8433d8d86eeec7e
SHA512

0119db8fc3befe5a7a19226709d397a965bbc26713584b6cbe9b1dbd7c0e525641868fbdd38d86a4faa29bf8ebe32d648b416a31768a53a8ef658e2694bd8461
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0T:jDgtfRQUHPw06MoV2nwTBlhm8b

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 3024	2076	rundll32.exe	28
PID 2076 wrote to memory of 3024	2076	rundll32.exe	28
PID 2076 wrote to memory of 3024	2076	rundll32.exe	28
PID 2076 wrote to memory of 3024	2076	rundll32.exe	28
PID 2076 wrote to memory of 3024	2076	rundll32.exe	28
PID 2076 wrote to memory of 3024	2076	rundll32.exe	28
PID 2076 wrote to memory of 3024	2076	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26a6c059d30b49795a76472987b2e0a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26a6c059d30b49795a76472987b2e0a0.dll,#1
  2⤵
  PID:3024