Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2024 02:52

General

  • Target

    b90ce4d01505f63bfcd9b392559f9b637b302cd26d2394a70f618234ac8883f8.dll

  • Size

    568KB

  • MD5

    dbb109139f8008bbf6ed8f54cd3f06f1

  • SHA1

    b0765a3ce6be2f44595d445ea566102c0309ef17

  • SHA256

    b90ce4d01505f63bfcd9b392559f9b637b302cd26d2394a70f618234ac8883f8

  • SHA512

    4625b88daa3d748ee958ab9d8ca55dcdd84458eb36754eb68a8522e612919f135c24797f8e1cb08dd612c743d54d794a0d67c0a5db196932185a6e57b41cc96d

  • SSDEEP

    3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0x:jDgtfRQUHPw06MoV2nwTBlhm8p

Malware Config

Signatures

  • Yunsip

    Remote backdoor which communicates with a C2 server to receive commands.

  • Yunsip family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b90ce4d01505f63bfcd9b392559f9b637b302cd26d2394a70f618234ac8883f8.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b90ce4d01505f63bfcd9b392559f9b637b302cd26d2394a70f618234ac8883f8.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads