yunsip | a1b2862c253e1bb1850131ae5e913ebc648648b33d7f3b27b50892861a276e2b

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
27-10-2023 03:14

Target

NEAS.458afdb525c0b4dfdda8997c46728790_JC.dll
Size

775KB
MD5

458afdb525c0b4dfdda8997c46728790
SHA1

e62ed47e83957fb847929a3a6528724550c54e6d
SHA256

a1b2862c253e1bb1850131ae5e913ebc648648b33d7f3b27b50892861a276e2b
SHA512

eced6af193cc6b39236d4d30ea624514a34407bab97c9c3c1fe0e23d88587cf1f682d167716892a3f087cead729a4e3d7d42b3670606380e0c94a5f5b2c515c1
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYv:o6RI1Fo/wT3cJYYYYYYYYYYYYv

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2948	2192	rundll32.exe	27
PID 2192 wrote to memory of 2948	2192	rundll32.exe	27
PID 2192 wrote to memory of 2948	2192	rundll32.exe	27
PID 2192 wrote to memory of 2948	2192	rundll32.exe	27
PID 2192 wrote to memory of 2948	2192	rundll32.exe	27
PID 2192 wrote to memory of 2948	2192	rundll32.exe	27
PID 2192 wrote to memory of 2948	2192	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.458afdb525c0b4dfdda8997c46728790_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.458afdb525c0b4dfdda8997c46728790_JC.dll,#1
  2⤵
  PID:2948