yunsip | 2641c2e75412fd1a11d718b5db5d8b144e4ac6e3d5ddf91b54f0e2879ab95bd5

Analysis

max time kernel
128s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 19:41

Target

NEAS.c67383f6122c30870447057381110210_JC.dll
Size

777KB
MD5

c67383f6122c30870447057381110210
SHA1

d6799cfad6191c55545377e50f69521e9895ec3a
SHA256

2641c2e75412fd1a11d718b5db5d8b144e4ac6e3d5ddf91b54f0e2879ab95bd5
SHA512

120aaadfc201686400709dfccc1f07f477d390352c0d0a030b43e4bb2310fa89ee2726c376d55f9ae805bc36b79ead0885dbe6ef64998278cdcd6ca84563c894
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYW:o6RI1Fo/wT3cJYYYYYYYYYYYYW

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 4972	3960	rundll32.exe	87
PID 3960 wrote to memory of 4972	3960	rundll32.exe	87
PID 3960 wrote to memory of 4972	3960	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.c67383f6122c30870447057381110210_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.c67383f6122c30870447057381110210_JC.dll,#1
  2⤵
  PID:4972