yunsip | 4a01b2a6f981f98e652ff0272c74954732bf70aad796f1ddaafd964160c7a919

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 06:28

Target

8fcd17e58088055fa4641d9adf369910_NeikiAnalytics.dll
Size

921KB
MD5

8fcd17e58088055fa4641d9adf369910
SHA1

b47e4ebd5efef8d8043cd98796e8eb1ed4f0adb9
SHA256

4a01b2a6f981f98e652ff0272c74954732bf70aad796f1ddaafd964160c7a919
SHA512

0771b9666bd05016be3a087bf389491433194719dcd59ae2cfe4593171e7b95570118fa36199adb100780ca82854eeecac8c972ce97f9be613c9de4f77b3ae38
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY2jjjjjjjjjjjjjjjjjjjjjjk:o6RI1Fo/wT3cJYYYYYYYYYYYY7

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2064	1960	rundll32.exe	28
PID 1960 wrote to memory of 2064	1960	rundll32.exe	28
PID 1960 wrote to memory of 2064	1960	rundll32.exe	28
PID 1960 wrote to memory of 2064	1960	rundll32.exe	28
PID 1960 wrote to memory of 2064	1960	rundll32.exe	28
PID 1960 wrote to memory of 2064	1960	rundll32.exe	28
PID 1960 wrote to memory of 2064	1960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fcd17e58088055fa4641d9adf369910_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fcd17e58088055fa4641d9adf369910_NeikiAnalytics.dll,#1
  2⤵
  PID:2064