yunsip | b7ba6c64a75827771e2f53a567f42cfdfc0a70059bb269207253f5f3706942fc

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 04:06

Target

1d3d165985392587a0aaa5cdd9f01e50_NeikiAnalytics.dll
Size

1.1MB
MD5

1d3d165985392587a0aaa5cdd9f01e50
SHA1

a17eba2c3cc4ec97dc8510f1632a6bb477b7b6a0
SHA256

b7ba6c64a75827771e2f53a567f42cfdfc0a70059bb269207253f5f3706942fc
SHA512

b45937c393f4d2a0ab2b0f324dc9f83d9a6992150e6415fce5aba07b6818f2047bd20c71e4682694a1e6b9bcad8caf78f15922bbc7240217a0663c0f33599329
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0s:jDgtfRQUHPw06MoV2nwTBlhm8E

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3040	3028	rundll32.exe	28
PID 3028 wrote to memory of 3040	3028	rundll32.exe	28
PID 3028 wrote to memory of 3040	3028	rundll32.exe	28
PID 3028 wrote to memory of 3040	3028	rundll32.exe	28
PID 3028 wrote to memory of 3040	3028	rundll32.exe	28
PID 3028 wrote to memory of 3040	3028	rundll32.exe	28
PID 3028 wrote to memory of 3040	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d3d165985392587a0aaa5cdd9f01e50_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d3d165985392587a0aaa5cdd9f01e50_NeikiAnalytics.dll,#1
  2⤵
  PID:3040