yunsip | 38df45a9850bb3fd8fe74557a83361be8603919a879ec5cdd639d6b6fc965497

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2024 22:15

Target

5c5150dbe6c848f849b82a91d42845a0_NeikiAnalytics.dll
Size

680KB
MD5

5c5150dbe6c848f849b82a91d42845a0
SHA1

f493a16f4a51b37d62588c0c0e74bc8b756922bb
SHA256

38df45a9850bb3fd8fe74557a83361be8603919a879ec5cdd639d6b6fc965497
SHA512

b365eb7986eb4cfeb5fd5b7e33cdda3f2ad4877f53f1f7c20fd50f930997f2cda3258e45a2ed96dc4af3655bd6a42af8398ac233ee6aec6f62a6e13d6d5547d1
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYq:o6RI1Fo/wT3cJYYYYYYYYYYYYq

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4992	1496	rundll32.exe	82
PID 1496 wrote to memory of 4992	1496	rundll32.exe	82
PID 1496 wrote to memory of 4992	1496	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c5150dbe6c848f849b82a91d42845a0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c5150dbe6c848f849b82a91d42845a0_NeikiAnalytics.dll,#1
  2⤵
  PID:4992