yunsip | e795209fa7e72ff0fb8e04dbe13f632fc5da0f5fb7ceb4b0a2cae24b6ccf3f4b

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2023 13:30

Target

NEAS.306f700a604e28ca6ca4050c46e7ba70.dll
Size

621KB
MD5

306f700a604e28ca6ca4050c46e7ba70
SHA1

d5f7d753bff3dc04db7d13876dea17cd75b1678c
SHA256

e795209fa7e72ff0fb8e04dbe13f632fc5da0f5fb7ceb4b0a2cae24b6ccf3f4b
SHA512

294b79e8a5e7cb452334667840ee4ad2de59286ec506b874d286d502bc82c993439b58f6d7881958a505e0cee89018100808e453dbf8aa3f5d783d1bdabdc62f
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY8:o6RI1Fo/wT3cJYYYYYYYYYYYY8

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 1908	3764	rundll32.exe	89
PID 3764 wrote to memory of 1908	3764	rundll32.exe	89
PID 3764 wrote to memory of 1908	3764	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.306f700a604e28ca6ca4050c46e7ba70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.306f700a604e28ca6ca4050c46e7ba70.dll,#1
  2⤵
  PID:1908