yunsip | 2096455bbb8483c4e490be81e5ed38f1f1b4fb32b6dda55a80a3ff01797acc27

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-10-2023 21:32

Target

NEAS.cdfca4e1e03fd2686e4d6127852b67a0.dll
Size

511KB
MD5

cdfca4e1e03fd2686e4d6127852b67a0
SHA1

1bd522300c449c46657f774665887b68597093b0
SHA256

2096455bbb8483c4e490be81e5ed38f1f1b4fb32b6dda55a80a3ff01797acc27
SHA512

c563011c44c3ec1ebd3ff12002688472090771656c15255dc2962f9347db55a482406713e96ce0018d3692a325f9832f4d9bb04657406620564b8a7425cba9d7
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYa:o6RI1Fo/wT3cJYYYYYYYYYYYYa

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2024 wrote to memory of 2452	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2452	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2452	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2452	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2452	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2452	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2452	2024	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cdfca4e1e03fd2686e4d6127852b67a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cdfca4e1e03fd2686e4d6127852b67a0.dll,#1
  2⤵
  PID:2452