yunsip | 233112f737aef876f96ae78441fb8093ea874a53a324c8ef0e02bc455549cf8e

Analysis

max time kernel
117s
max time network
142s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
27-10-2023 01:38

Target

NEAS.85ff4034848a3cdf4bfdb0ee16455d30_JC.dll
Size

818KB
MD5

85ff4034848a3cdf4bfdb0ee16455d30
SHA1

e1c25bed7d92db14d3d9a170c0ba7a56b2f8ee4e
SHA256

233112f737aef876f96ae78441fb8093ea874a53a324c8ef0e02bc455549cf8e
SHA512

809e255d006b27ebfc4d947e5b8df7ff14303f99da56bfa485c8cd1790af993ff05b329703609a2a44d65d2607daa5c9e03230f7638f496fcfd5c9effab5c90f
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0/:jDgtfRQUHPw06MoV2nwTBlhm8X

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2712	2608	rundll32.exe	29
PID 2608 wrote to memory of 2712	2608	rundll32.exe	29
PID 2608 wrote to memory of 2712	2608	rundll32.exe	29
PID 2608 wrote to memory of 2712	2608	rundll32.exe	29
PID 2608 wrote to memory of 2712	2608	rundll32.exe	29
PID 2608 wrote to memory of 2712	2608	rundll32.exe	29
PID 2608 wrote to memory of 2712	2608	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.85ff4034848a3cdf4bfdb0ee16455d30_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.85ff4034848a3cdf4bfdb0ee16455d30_JC.dll,#1
  2⤵
  PID:2712