yunsip | 9644618b1b3e383aacead58705b5bf9761c06e311bfd9089e677d834ce48d005

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22-10-2023 17:20

Target

NEAS.6178f6e0d63f4e838ed62ba19aeea160.dll
Size

622KB
MD5

6178f6e0d63f4e838ed62ba19aeea160
SHA1

c3310ae1759629690ca6586cc03ec199f8826fbd
SHA256

9644618b1b3e383aacead58705b5bf9761c06e311bfd9089e677d834ce48d005
SHA512

353386b0c1261e3450515469b20063a978b9ec284becc0c6c82f119b81ff2162270d9299304253cc7fa37133bd234e9bf8e0e30fa7d092ef5493c45c94fd07fc
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYN:o6RI1Fo/wT3cJYYYYYYYYYYYYN

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 1496	2668	rundll32.exe	27
PID 2668 wrote to memory of 1496	2668	rundll32.exe	27
PID 2668 wrote to memory of 1496	2668	rundll32.exe	27
PID 2668 wrote to memory of 1496	2668	rundll32.exe	27
PID 2668 wrote to memory of 1496	2668	rundll32.exe	27
PID 2668 wrote to memory of 1496	2668	rundll32.exe	27
PID 2668 wrote to memory of 1496	2668	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6178f6e0d63f4e838ed62ba19aeea160.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6178f6e0d63f4e838ed62ba19aeea160.dll,#1
  2⤵
  PID:1496