yunsip | 416b4b83ffa31dd96b209898fdac4e264144b1610758e4691f6cc8218332851d

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
08-11-2023 04:43

Target

NEAS.a50279abf94d8f03f0f3629568c150a0.dll
Size

1.0MB
MD5

a50279abf94d8f03f0f3629568c150a0
SHA1

82f301a9df2d17c0a7989fdebaa667f0efeb23e0
SHA256

416b4b83ffa31dd96b209898fdac4e264144b1610758e4691f6cc8218332851d
SHA512

bb31fac21f0871109018f3900279a0fe4d28f8f98e1e01dee79b57e846182a66b8e8d8d16ae0f8d20abaf5d7763b81df0aa0dc2ac10ffd193b3712408c2a8149
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYi:o6RI1Fo/wT3cJYYYYYYYYYYYYi

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2316	1988	rundll32.exe	28
PID 1988 wrote to memory of 2316	1988	rundll32.exe	28
PID 1988 wrote to memory of 2316	1988	rundll32.exe	28
PID 1988 wrote to memory of 2316	1988	rundll32.exe	28
PID 1988 wrote to memory of 2316	1988	rundll32.exe	28
PID 1988 wrote to memory of 2316	1988	rundll32.exe	28
PID 1988 wrote to memory of 2316	1988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.a50279abf94d8f03f0f3629568c150a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.a50279abf94d8f03f0f3629568c150a0.dll,#1
  2⤵
  PID:2316