yunsip | a88b877a34f4a7cbf8ecd6265234242eb6863291f1a4b13e4dcb0312ba9f95c3

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2023 02:15

Target

NEAS.334ba0e26cb058394e570edb30f1aa80_JC.dll
Size

818KB
MD5

334ba0e26cb058394e570edb30f1aa80
SHA1

ef2a32861550feea7ba1eef28793d9317cad4879
SHA256

a88b877a34f4a7cbf8ecd6265234242eb6863291f1a4b13e4dcb0312ba9f95c3
SHA512

690cd898c0110fb7f9978de83cf6d60ae0e536b80ef698e60d59ead80ce9af574c1fce241861c6e8590868023408a96c6a216be00e510b704c79273ddce8d91e
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0f:jDgtfRQUHPw06MoV2nwTBlhm8X

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 4284	3448	rundll32.exe	82
PID 3448 wrote to memory of 4284	3448	rundll32.exe	82
PID 3448 wrote to memory of 4284	3448	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.334ba0e26cb058394e570edb30f1aa80_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.334ba0e26cb058394e570edb30f1aa80_JC.dll,#1
  2⤵
  PID:4284