yunsip | ca16826a60648bde7e5bfef4a7e7f8cd43b7d463e585171e7b08c90b6d721e0f

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 14:21

Target

c3866488eba95df803944be97fcfe960_NeikiAnalytics.dll
Size

1.2MB
MD5

c3866488eba95df803944be97fcfe960
SHA1

9647bc104281aea48a1fe4e872fe38a2f954a4f1
SHA256

ca16826a60648bde7e5bfef4a7e7f8cd43b7d463e585171e7b08c90b6d721e0f
SHA512

691e741c1af463282280071a3267c8e40a840d2b9e0cdcc8f73b86cc8f2514590e7fd20905f7e70d30ab8d889cd33b87a3f232b1609142d180dd614202dae1ef
SSDEEP

12288:jDgN6MoIwT3qOOOOOOOOOOOOOOOOOOOOOO:jTtT3qOOOOOOOOOOOOOOOOOOOOOO

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 820	1812	rundll32.exe	28
PID 1812 wrote to memory of 820	1812	rundll32.exe	28
PID 1812 wrote to memory of 820	1812	rundll32.exe	28
PID 1812 wrote to memory of 820	1812	rundll32.exe	28
PID 1812 wrote to memory of 820	1812	rundll32.exe	28
PID 1812 wrote to memory of 820	1812	rundll32.exe	28
PID 1812 wrote to memory of 820	1812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3866488eba95df803944be97fcfe960_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3866488eba95df803944be97fcfe960_NeikiAnalytics.dll,#1
  2⤵
  PID:820