yunsip | 1c2fcd5ad51bd6ad72fb821b54c1caf5a6534babc5702f5768daef299e676250

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
25-10-2023 21:52

Target

NEAS.d167316fa7a15ca6781b015b105aca60.dll
Size

659KB
MD5

d167316fa7a15ca6781b015b105aca60
SHA1

4119dc39e40584829cca4bbc530f48c86a597514
SHA256

1c2fcd5ad51bd6ad72fb821b54c1caf5a6534babc5702f5768daef299e676250
SHA512

c976c12a99b0a0a0700abbf073a261754a91c3743c838acf17da57aa9342d66d50e26f71bf13f75413679dd0ea96da826025d7e536ed84777fd0064ce191290e
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY9:o6RI1Fo/wT3cJYYYYYYYYYYYY9

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1744	1736	rundll32.exe	28
PID 1736 wrote to memory of 1744	1736	rundll32.exe	28
PID 1736 wrote to memory of 1744	1736	rundll32.exe	28
PID 1736 wrote to memory of 1744	1736	rundll32.exe	28
PID 1736 wrote to memory of 1744	1736	rundll32.exe	28
PID 1736 wrote to memory of 1744	1736	rundll32.exe	28
PID 1736 wrote to memory of 1744	1736	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d167316fa7a15ca6781b015b105aca60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d167316fa7a15ca6781b015b105aca60.dll,#1
  2⤵
  PID:1744