yunsip | 1c2fcd5ad51bd6ad72fb821b54c1caf5a6534babc5702f5768daef299e676250

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
25-10-2023 21:52

Target

NEAS.d167316fa7a15ca6781b015b105aca60.dll
Size

659KB
MD5

d167316fa7a15ca6781b015b105aca60
SHA1

4119dc39e40584829cca4bbc530f48c86a597514
SHA256

1c2fcd5ad51bd6ad72fb821b54c1caf5a6534babc5702f5768daef299e676250
SHA512

c976c12a99b0a0a0700abbf073a261754a91c3743c838acf17da57aa9342d66d50e26f71bf13f75413679dd0ea96da826025d7e536ed84777fd0064ce191290e
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY9:o6RI1Fo/wT3cJYYYYYYYYYYYY9

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 224 wrote to memory of 448	224	rundll32.exe	rundll32.exe
PID 224 wrote to memory of 448	224	rundll32.exe	rundll32.exe
PID 224 wrote to memory of 448	224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d167316fa7a15ca6781b015b105aca60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d167316fa7a15ca6781b015b105aca60.dll,#1
2⤵
PID:448