yunsip | db2f4547987263ee214513d03b4414130e91894807afec7da08cbdb95ba4269f

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 23:41

Target

8437b23e8ffce6484b927a0e2a95b750_NeikiAnalytics.dll
Size

1.2MB
MD5

8437b23e8ffce6484b927a0e2a95b750
SHA1

32d4c388349039f4a6e4ea2cbffd406b280ebfd8
SHA256

db2f4547987263ee214513d03b4414130e91894807afec7da08cbdb95ba4269f
SHA512

df7b17e695c017a04c0098d45c95500740f1b73af1dce690db982ebd6bf988decf91200060188d7efbb3d8e16279bc0d1063563ea4092e6e3742df1726bedaf6
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0w:jDgtfRQUHPw06MoV2nwTBlhm84

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2856 wrote to memory of 3868	2856	rundll32.exe	rundll32.exe
PID 2856 wrote to memory of 3868	2856	rundll32.exe	rundll32.exe
PID 2856 wrote to memory of 3868	2856	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8437b23e8ffce6484b927a0e2a95b750_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8437b23e8ffce6484b927a0e2a95b750_NeikiAnalytics.dll,#1
2⤵
PID:3868