yunsip | ac663c1dccf3868c4a2e3ee6bc16c3c5dd351c9abbb93313f45f5ef51154d862

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 13:11

Target

ca75f031ad969647c232eca59552b0c0_NeikiAnalytics.dll
Size

508KB
MD5

ca75f031ad969647c232eca59552b0c0
SHA1

5dad46c24b47e53e313f22d3b874aed432df9eb3
SHA256

ac663c1dccf3868c4a2e3ee6bc16c3c5dd351c9abbb93313f45f5ef51154d862
SHA512

69433de8471bd10944e8421d1c5c18da8f9bf7c58f704ced18b3a20cfac076893d5d69985edbc5d24e23cb09d8b461ea288d2826f4fd0248306fdd351ab812e7
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q01:jDgtfRQUHPw06MoV2nwTBlhm89

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca75f031ad969647c232eca59552b0c0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca75f031ad969647c232eca59552b0c0_NeikiAnalytics.dll,#1
  2⤵
  PID:3064