yunsip | b2456ae024f420f24374bd9e57dc4c488580f424d73ae065809fbdbe15141fb5

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05-11-2023 20:15

Target

NEAS.8b2d922d7e8f91cd201142f447694fd0.dll
Size

705KB
MD5

8b2d922d7e8f91cd201142f447694fd0
SHA1

0404f19360a0d61b0ba8d7bd4e699a811ab85d8a
SHA256

b2456ae024f420f24374bd9e57dc4c488580f424d73ae065809fbdbe15141fb5
SHA512

7e8c0a2a26a94729800db134a3696b2e038c5f083a26a437d5f6a017a46241e5c6fad47242c471c83174153283cac09d3804239d91d7935a06e6009ddda78fc1
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY8:o6RI1Fo/wT3cJYYYYYYYYYYYY8

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.8b2d922d7e8f91cd201142f447694fd0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.8b2d922d7e8f91cd201142f447694fd0.dll,#1
  2⤵
  PID:1600