yunsip | 3d45b66627dac30d2d2cec41286e3fb4605f2f02008fd6a9f2320f9f270248f6

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 04:27

Target

3d45b66627dac30d2d2cec41286e3fb4605f2f02008fd6a9f2320f9f270248f6_NeikiAnalytics.dll
Size

918KB
MD5

4680426dd58d30fb767bd8fe21871bb0
SHA1

6ee4492c4d900290a4b2f98f226345beaaf6f0f5
SHA256

3d45b66627dac30d2d2cec41286e3fb4605f2f02008fd6a9f2320f9f270248f6
SHA512

b46c872dd06232c29d86ef2839edfdb513036d6d7dde3db698316b98e4683053d9c712d3c5cd5e4f783803dc3b7189fda88a8c3afa0db5789b307c215dbccd26
SSDEEP

6144:jDgtfRQUHPw06MoV2nwTBlhm8zDgtfRQUHPw06MoV2nwTBlhm8b:jDgN6MoIwT3vDgN6MoIwT3/

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28
PID 2068 wrote to memory of 2012	2068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d45b66627dac30d2d2cec41286e3fb4605f2f02008fd6a9f2320f9f270248f6_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d45b66627dac30d2d2cec41286e3fb4605f2f02008fd6a9f2320f9f270248f6_NeikiAnalytics.dll,#1
  2⤵
  PID:2012