yunsip | a1e5c8fd6e71c36134ab236ac699587700a6b46ff893c7be0cf8e129a879ee83

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 00:47

Target

5225ba4a3361a3ba2579688512ea5fc0_NeikiAnalytics.dll
Size

444KB
MD5

5225ba4a3361a3ba2579688512ea5fc0
SHA1

15977f7de0f3895d7ffa947f922953f6d05bfdb9
SHA256

a1e5c8fd6e71c36134ab236ac699587700a6b46ff893c7be0cf8e129a879ee83
SHA512

03333723519ae3b91f92e5afb947f034f334c2e9330d65f4b49dfa7c47198e2e1a7334d5cab47530c445359971bc2de9385ab4e3ebbafad4cb8a97f660aa8ea2
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q02:jDgtfRQUHPw06MoV2nwTBlhm8u

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2068	2220	rundll32.exe	28
PID 2220 wrote to memory of 2068	2220	rundll32.exe	28
PID 2220 wrote to memory of 2068	2220	rundll32.exe	28
PID 2220 wrote to memory of 2068	2220	rundll32.exe	28
PID 2220 wrote to memory of 2068	2220	rundll32.exe	28
PID 2220 wrote to memory of 2068	2220	rundll32.exe	28
PID 2220 wrote to memory of 2068	2220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5225ba4a3361a3ba2579688512ea5fc0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5225ba4a3361a3ba2579688512ea5fc0_NeikiAnalytics.dll,#1
  2⤵
  PID:2068