yunsip | b6ba1f6b4be2db373e855df761384432a54e8198d303862924ecb6588d7ad8a0

Analysis

max time kernel
139s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2023 21:24

Target

NEAS.7c0f93b0479510ff271497752518ab30.dll
Size

689KB
MD5

7c0f93b0479510ff271497752518ab30
SHA1

2c6ab5006f0a7cbbdb2b96e64b1b0b8122c0fd7d
SHA256

b6ba1f6b4be2db373e855df761384432a54e8198d303862924ecb6588d7ad8a0
SHA512

77520d9862d80731b2998ba589e58aee58aa8be1324749d4fd9d180834bf1a3eb0fe0a59f01512ca68d843b1f710d341f1b7008a7caff01ba7de053e644ce0df
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYp:o6RI1Fo/wT3cJYYYYYYYYYYYYp

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2412 wrote to memory of 4552	2412	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 4552	2412	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 4552	2412	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.7c0f93b0479510ff271497752518ab30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.7c0f93b0479510ff271497752518ab30.dll,#1
2⤵
PID:4552