yunsip | f53e53b59d413d9ec2e732dcc80506e310c495624df86a6541ad652b85926eed

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 09:04

Target

3c88109e22312a3d09a679ed0f710030_NeikiAnalytics.dll
Size

1.0MB
MD5

3c88109e22312a3d09a679ed0f710030
SHA1

19da28a0182b94ceca7acd458771c005d8eb7608
SHA256

f53e53b59d413d9ec2e732dcc80506e310c495624df86a6541ad652b85926eed
SHA512

0380e3aa1dd126d3d54793c529124e687f95981bf1bfe11e722fa1d63e37d82b0699b0526fe8162eed2ded49aae50e46ce553fbc9f3f517e6e648b0179d0694d
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYi:o6RI1Fo/wT3cJYYYYYYYYYYYYi

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28
PID 2172 wrote to memory of 2356	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c88109e22312a3d09a679ed0f710030_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c88109e22312a3d09a679ed0f710030_NeikiAnalytics.dll,#1
  2⤵
  PID:2356