yunsip | d83a2cfa69faaa433c8f65a4d0e502386374e10af2c4bb8d481af9d2e0162e15

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 17:37

Target

46d5eb54c3e32986801aa0cff0fa5c69_JaffaCakes118.dll
Size

438KB
MD5

46d5eb54c3e32986801aa0cff0fa5c69
SHA1

8da22a7a6a226b704be96f9fbb7e63aa43fb1881
SHA256

d83a2cfa69faaa433c8f65a4d0e502386374e10af2c4bb8d481af9d2e0162e15
SHA512

446d2986e705235790536e604f75832a6a629aaed995c28b46dc80ce28f16a9a1df16396613f70c2d76c216208295b2124f0b8c05e5771ef0a34e1d23411cff1
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDl:o6C5AXbMn7UI1FoV2gwTBlrIckP7

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 2092	1480	rundll32.exe	31
PID 1480 wrote to memory of 2092	1480	rundll32.exe	31
PID 1480 wrote to memory of 2092	1480	rundll32.exe	31
PID 1480 wrote to memory of 2092	1480	rundll32.exe	31
PID 1480 wrote to memory of 2092	1480	rundll32.exe	31
PID 1480 wrote to memory of 2092	1480	rundll32.exe	31
PID 1480 wrote to memory of 2092	1480	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46d5eb54c3e32986801aa0cff0fa5c69_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46d5eb54c3e32986801aa0cff0fa5c69_JaffaCakes118.dll,#1
  2⤵
  PID:2092