yunsip | 9644618b1b3e383aacead58705b5bf9761c06e311bfd9089e677d834ce48d005

Analysis

max time kernel
140s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2023 17:20

Target

NEAS.6178f6e0d63f4e838ed62ba19aeea160.dll
Size

622KB
MD5

6178f6e0d63f4e838ed62ba19aeea160
SHA1

c3310ae1759629690ca6586cc03ec199f8826fbd
SHA256

9644618b1b3e383aacead58705b5bf9761c06e311bfd9089e677d834ce48d005
SHA512

353386b0c1261e3450515469b20063a978b9ec284becc0c6c82f119b81ff2162270d9299304253cc7fa37133bd234e9bf8e0e30fa7d092ef5493c45c94fd07fc
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYN:o6RI1Fo/wT3cJYYYYYYYYYYYYN

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2240 wrote to memory of 2236	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2236	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2236	2240	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6178f6e0d63f4e838ed62ba19aeea160.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6178f6e0d63f4e838ed62ba19aeea160.dll,#1
2⤵
PID:2236