yunsip | 05f84105f313547b512b631e5c45b02adaacb2a98975f53283ce3ac6d18eed75

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 20:03

Target

05f84105f313547b512b631e5c45b02adaacb2a98975f53283ce3ac6d18eed75_NeikiAnalytics.dll
Size

617KB
MD5

0c33d81cfbef838759f69256845d2530
SHA1

ff7f65b7c522013c5051718f511104ba320039e9
SHA256

05f84105f313547b512b631e5c45b02adaacb2a98975f53283ce3ac6d18eed75
SHA512

c080b98933545158c51021028ff586e042927fa32f372a30829f7b5913fb8300c4035a8571f615f14fc72166e8dd6c79c64042ef43cafc195090bc8595599525
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYM:o6RI1Fo/wT3cJYYYYYYYYYYYYM

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 764	4524	rundll32.exe	82
PID 4524 wrote to memory of 764	4524	rundll32.exe	82
PID 4524 wrote to memory of 764	4524	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05f84105f313547b512b631e5c45b02adaacb2a98975f53283ce3ac6d18eed75_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05f84105f313547b512b631e5c45b02adaacb2a98975f53283ce3ac6d18eed75_NeikiAnalytics.dll,#1
  2⤵
  PID:764