yunsip | b6ba1f6b4be2db373e855df761384432a54e8198d303862924ecb6588d7ad8a0

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-10-2023 21:24

Target

NEAS.7c0f93b0479510ff271497752518ab30.dll
Size

689KB
MD5

7c0f93b0479510ff271497752518ab30
SHA1

2c6ab5006f0a7cbbdb2b96e64b1b0b8122c0fd7d
SHA256

b6ba1f6b4be2db373e855df761384432a54e8198d303862924ecb6588d7ad8a0
SHA512

77520d9862d80731b2998ba589e58aee58aa8be1324749d4fd9d180834bf1a3eb0fe0a59f01512ca68d843b1f710d341f1b7008a7caff01ba7de053e644ce0df
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYp:o6RI1Fo/wT3cJYYYYYYYYYYYYp

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1896	2196	rundll32.exe	28
PID 2196 wrote to memory of 1896	2196	rundll32.exe	28
PID 2196 wrote to memory of 1896	2196	rundll32.exe	28
PID 2196 wrote to memory of 1896	2196	rundll32.exe	28
PID 2196 wrote to memory of 1896	2196	rundll32.exe	28
PID 2196 wrote to memory of 1896	2196	rundll32.exe	28
PID 2196 wrote to memory of 1896	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.7c0f93b0479510ff271497752518ab30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.7c0f93b0479510ff271497752518ab30.dll,#1
  2⤵
  PID:1896