yunsip | 6ab07dcba9ac8bb102e13daf7b3129fdd0ffbe66dd0019996df07758500fba87

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 17:52

Target

NEAS.3ee18b5c5060a658baf799c23b11c5e0.dll
Size

189KB
MD5

3ee18b5c5060a658baf799c23b11c5e0
SHA1

d491900d6e7fa886e3b51aebc3cbfe457691a2cd
SHA256

6ab07dcba9ac8bb102e13daf7b3129fdd0ffbe66dd0019996df07758500fba87
SHA512

5cab1b3ae0c3903e9381a60bc93250ef9027df316ea882b9d6c54ec79266c248b298c1cc4a605a5ed8f240852180b20e1271841ee4f2c743918fcf90e7bf2c27
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0B:jDgtfRQUHPw06MoV2nwTBlhm85

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2676	2364	rundll32.exe	28
PID 2364 wrote to memory of 2676	2364	rundll32.exe	28
PID 2364 wrote to memory of 2676	2364	rundll32.exe	28
PID 2364 wrote to memory of 2676	2364	rundll32.exe	28
PID 2364 wrote to memory of 2676	2364	rundll32.exe	28
PID 2364 wrote to memory of 2676	2364	rundll32.exe	28
PID 2364 wrote to memory of 2676	2364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3ee18b5c5060a658baf799c23b11c5e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3ee18b5c5060a658baf799c23b11c5e0.dll,#1
  2⤵
  PID:2676