yunsip | 909671c026f43206c31bdbc931a40e0f6882bfd0fea29d55a2e9a52bb3381d7d

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2023 18:00

Target

NEAS.58e4d3b4be185f60d6ae1fc9c52254c0_JC.dll
Size

1.1MB
MD5

58e4d3b4be185f60d6ae1fc9c52254c0
SHA1

90b67e55d6a739dc387e36da9cc1bdd51a9dadab
SHA256

909671c026f43206c31bdbc931a40e0f6882bfd0fea29d55a2e9a52bb3381d7d
SHA512

626f1051f96299440e76c74e62b5fa22d9aea639d1c0bae9d67fe3273f4d7e0a10b37fc3f1e66426278d06e879aa3131a9aa5044126e977e722cf10e03b38cef
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0Y:jDgtfRQUHPw06MoV2nwTBlhm8w

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1356 wrote to memory of 3992	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 3992	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 3992	1356	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.58e4d3b4be185f60d6ae1fc9c52254c0_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.58e4d3b4be185f60d6ae1fc9c52254c0_JC.dll,#1
2⤵
PID:3992