yunsip | 97f2ee7109806ffc98049f6ef88addd2ac987de618e182e0a86a760e7fdef136

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 13:12

Target

55448088cb83c1e65539b64f8ec033b0_NeikiAnalytics.dll
Size

1.0MB
MD5

55448088cb83c1e65539b64f8ec033b0
SHA1

b0ff81cf2bdef5af246da176670aebb611112113
SHA256

97f2ee7109806ffc98049f6ef88addd2ac987de618e182e0a86a760e7fdef136
SHA512

79438ed4ed8bc343c493bc0df79bf1a2332885691cf85773ae3ef9fbbab74ee7457a43012f19deb34e751659066199c5df3827abb9a5b7a74eec4debb7acb20f
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYg:o6RI1Fo/wT3cJYYYYYYYYYYYYg

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1580	2664	rundll32.exe	28
PID 2664 wrote to memory of 1580	2664	rundll32.exe	28
PID 2664 wrote to memory of 1580	2664	rundll32.exe	28
PID 2664 wrote to memory of 1580	2664	rundll32.exe	28
PID 2664 wrote to memory of 1580	2664	rundll32.exe	28
PID 2664 wrote to memory of 1580	2664	rundll32.exe	28
PID 2664 wrote to memory of 1580	2664	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55448088cb83c1e65539b64f8ec033b0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55448088cb83c1e65539b64f8ec033b0_NeikiAnalytics.dll,#1
  2⤵
  PID:1580