yunsip | 29ce983e4743b7343979a437e878604b6a6c3570bdb39e1cf71f254621c4eadc

Analysis

max time kernel
126s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 02:03

Target

5497ef087bdbba632a64a64cc6f29480_NeikiAnalytics.dll
Size

701KB
MD5

5497ef087bdbba632a64a64cc6f29480
SHA1

7df6619956342437a53523e896e53404cfb21458
SHA256

29ce983e4743b7343979a437e878604b6a6c3570bdb39e1cf71f254621c4eadc
SHA512

d3ef4fa2f9c019b2248f7291c17e4d54e618ace8b4cda5ff7ef277e39a9629fc8a61106d822987ebe8aff360db5ed166ce23917be655be79fc8d284ba7fc5e9f
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYz:o6RI1Fo/wT3cJYYYYYYYYYYYYz

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 3448	1816	rundll32.exe	90
PID 1816 wrote to memory of 3448	1816	rundll32.exe	90
PID 1816 wrote to memory of 3448	1816	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5497ef087bdbba632a64a64cc6f29480_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5497ef087bdbba632a64a64cc6f29480_NeikiAnalytics.dll,#1
  2⤵
  PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4076,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:8
1⤵
PID:2248