yunsip | ca2b982226544fbc013725fa71d5a57667575391ad9e025f1a2c0e8b7461f0bc

Analysis

max time kernel
135s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2023 03:15

Target

NEAS.a458bf085bc010b25e3956ba5e524210_JC.dll
Size

812KB
MD5

a458bf085bc010b25e3956ba5e524210
SHA1

6d0c74677bf72ea238590b17fed9e1d4261ff3a9
SHA256

ca2b982226544fbc013725fa71d5a57667575391ad9e025f1a2c0e8b7461f0bc
SHA512

05ebc625a1f66a34b7df5fd8451beee7be774bf4fbb03cad03e6c64100277063fbcece5fc9b882d2b159ca8eab1648ab981997272a39fb3c5fc2a02bb0cd7f70
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0X:jDgtfRQUHPw06MoV2nwTBlhm8v

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4276	2864	rundll32.exe	86
PID 2864 wrote to memory of 4276	2864	rundll32.exe	86
PID 2864 wrote to memory of 4276	2864	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.a458bf085bc010b25e3956ba5e524210_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.a458bf085bc010b25e3956ba5e524210_JC.dll,#1
  2⤵
  PID:4276