yunsip | 2096455bbb8483c4e490be81e5ed38f1f1b4fb32b6dda55a80a3ff01797acc27

Analysis

max time kernel
109s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2023 21:32

Target

NEAS.cdfca4e1e03fd2686e4d6127852b67a0.dll
Size

511KB
MD5

cdfca4e1e03fd2686e4d6127852b67a0
SHA1

1bd522300c449c46657f774665887b68597093b0
SHA256

2096455bbb8483c4e490be81e5ed38f1f1b4fb32b6dda55a80a3ff01797acc27
SHA512

c563011c44c3ec1ebd3ff12002688472090771656c15255dc2962f9347db55a482406713e96ce0018d3692a325f9832f4d9bb04657406620564b8a7425cba9d7
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYa:o6RI1Fo/wT3cJYYYYYYYYYYYYa

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3492 wrote to memory of 1724	3492	rundll32.exe	rundll32.exe
PID 3492 wrote to memory of 1724	3492	rundll32.exe	rundll32.exe
PID 3492 wrote to memory of 1724	3492	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cdfca4e1e03fd2686e4d6127852b67a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cdfca4e1e03fd2686e4d6127852b67a0.dll,#1
  2⤵
  PID:1724