yunsip | db2f4547987263ee214513d03b4414130e91894807afec7da08cbdb95ba4269f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 23:41

Target

8437b23e8ffce6484b927a0e2a95b750_NeikiAnalytics.dll
Size

1.2MB
MD5

8437b23e8ffce6484b927a0e2a95b750
SHA1

32d4c388349039f4a6e4ea2cbffd406b280ebfd8
SHA256

db2f4547987263ee214513d03b4414130e91894807afec7da08cbdb95ba4269f
SHA512

df7b17e695c017a04c0098d45c95500740f1b73af1dce690db982ebd6bf988decf91200060188d7efbb3d8e16279bc0d1063563ea4092e6e3742df1726bedaf6
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0w:jDgtfRQUHPw06MoV2nwTBlhm84

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 848	2180	rundll32.exe	28
PID 2180 wrote to memory of 848	2180	rundll32.exe	28
PID 2180 wrote to memory of 848	2180	rundll32.exe	28
PID 2180 wrote to memory of 848	2180	rundll32.exe	28
PID 2180 wrote to memory of 848	2180	rundll32.exe	28
PID 2180 wrote to memory of 848	2180	rundll32.exe	28
PID 2180 wrote to memory of 848	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8437b23e8ffce6484b927a0e2a95b750_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8437b23e8ffce6484b927a0e2a95b750_NeikiAnalytics.dll,#1
  2⤵
  PID:848