yunsip | 29f7131a5a0912f946876d8f596ffc17b8dbbb26ea80cadbe4ccfeda31e1a236

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 01:42

Target

7d8c90feb3e24eb3fac1b3f9ebab78e0_NeikiAnalytics.dll
Size

606KB
MD5

7d8c90feb3e24eb3fac1b3f9ebab78e0
SHA1

9bf23cce09f7abdd7db64869870f7ae32876a319
SHA256

29f7131a5a0912f946876d8f596ffc17b8dbbb26ea80cadbe4ccfeda31e1a236
SHA512

c6635e484c00269a7c9397c0d2af2d8de214a7ca3295c86eecd7e9ac76a3cf49711f9a4dcbb76944a7a56ae13e19bd8c391f0e6a85c031dfb52dcd0ec80fe0f0
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYl:o6RI1Fo/wT3cJYYYYYYYYYYYYl

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 3048	2888	rundll32.exe	28
PID 2888 wrote to memory of 3048	2888	rundll32.exe	28
PID 2888 wrote to memory of 3048	2888	rundll32.exe	28
PID 2888 wrote to memory of 3048	2888	rundll32.exe	28
PID 2888 wrote to memory of 3048	2888	rundll32.exe	28
PID 2888 wrote to memory of 3048	2888	rundll32.exe	28
PID 2888 wrote to memory of 3048	2888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d8c90feb3e24eb3fac1b3f9ebab78e0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d8c90feb3e24eb3fac1b3f9ebab78e0_NeikiAnalytics.dll,#1
  2⤵
  PID:3048