yunsip | 99f662caf9123079b4a0808d2cef28a7923ab681b57911cf031e1be749562c67

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 19:36

Target

21510f856625178ca207afc73ecd1950_NeikiAnalytics.dll
Size

693KB
MD5

21510f856625178ca207afc73ecd1950
SHA1

8694f40ac973c8cc82ae5e02a1d0d1da6a5947c8
SHA256

99f662caf9123079b4a0808d2cef28a7923ab681b57911cf031e1be749562c67
SHA512

110d157d4464cbf7355df0cdf22a40d765972736598731b6dfdb61b6874ba10534adb9cb0e5468bee2b1c3bf5c74b92c7d180eae325e135a11e0bb60e2cafe64
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYf:o6RI1Fo/wT3cJYYYYYYYYYYYYf

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2936 wrote to memory of 2476	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 2476	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 2476	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 2476	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 2476	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 2476	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 2476	2936	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21510f856625178ca207afc73ecd1950_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21510f856625178ca207afc73ecd1950_NeikiAnalytics.dll,#1
2⤵
PID:2476