yunsip | 9536a3bfba95803f1e8e2aef542c1c771d21f30807b3a5954f012c9de75e3f67

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 11:36

Target

5d0ab47e6b54e45293fdaaa90aee3c40_NEAS.dll
Size

1.0MB
MD5

5d0ab47e6b54e45293fdaaa90aee3c40
SHA1

1ade192ad1dbf6b72964d2d31699c4d868ce1003
SHA256

9536a3bfba95803f1e8e2aef542c1c771d21f30807b3a5954f012c9de75e3f67
SHA512

738ad50db28abf8ad7a10fae2b8388b4c39f1cc048d2e1e3e15d9918f588792f84480c076fe34e12241535b193ea7d5775f1a9be720924b8e8814ef3cb55690b
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY9:o6RI1Fo/wT3cJYYYYYYYYYYYY9

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 1784	2452	rundll32.exe	28
PID 2452 wrote to memory of 1784	2452	rundll32.exe	28
PID 2452 wrote to memory of 1784	2452	rundll32.exe	28
PID 2452 wrote to memory of 1784	2452	rundll32.exe	28
PID 2452 wrote to memory of 1784	2452	rundll32.exe	28
PID 2452 wrote to memory of 1784	2452	rundll32.exe	28
PID 2452 wrote to memory of 1784	2452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d0ab47e6b54e45293fdaaa90aee3c40_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d0ab47e6b54e45293fdaaa90aee3c40_NEAS.dll,#1
  2⤵
  PID:1784