yunsip | 1737413725e8d392ec963daaef359b25cf529f971335a5cd4b2fea95ddabc613

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 20:23

Target

NEAS.501afcddc0294cc0d853217d4aaf9570.dll
Size

332KB
MD5

501afcddc0294cc0d853217d4aaf9570
SHA1

c4bc4ee943fe83ad7a203553bcdded042f9f0350
SHA256

1737413725e8d392ec963daaef359b25cf529f971335a5cd4b2fea95ddabc613
SHA512

c1db5ba6855c9a22902c69209c4c0dfb141a06e55265b168fab2177b5ac7ecec611cd171080e2859299ec7213f6823a7d441da06d027ed9d4630e7cf6bc09e50
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDO:o6C5AXbMn7UI1FoV2gwTBlrIckPs

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1256 wrote to memory of 2260	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 2260	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 2260	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 2260	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 2260	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 2260	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 2260	1256	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.501afcddc0294cc0d853217d4aaf9570.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.501afcddc0294cc0d853217d4aaf9570.dll,#1
2⤵
PID:2260