yunsip | 27bb359f499d3ae0054426a0fff7d290f97da3a5d50768184c44aad65b30f1e1

Analysis

max time kernel
129s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 00:00

Target

27bb359f499d3ae0054426a0fff7d290f97da3a5d50768184c44aad65b30f1e1_NeikiAnalytics.dll
Size

968KB
MD5

f5951415e499e4ee549d366a3e54a390
SHA1

9ccc90196cb061dc962641308cb54650f9546173
SHA256

27bb359f499d3ae0054426a0fff7d290f97da3a5d50768184c44aad65b30f1e1
SHA512

b4388e046f06637c17e30b643b3149446f160248d00842c17b9cf096d7bd82ff412c6457c4a454b5182e6d5235e71ee014c4324d4322425bf880d9e62df19d04
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY2jjjjjjjjjjjjjjjjjjjjjjt:o6RI1Fo/wT3cJYYYYYYYYYYYYy

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2432 wrote to memory of 4296	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 4296	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 4296	2432	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27bb359f499d3ae0054426a0fff7d290f97da3a5d50768184c44aad65b30f1e1_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27bb359f499d3ae0054426a0fff7d290f97da3a5d50768184c44aad65b30f1e1_NeikiAnalytics.dll,#1
2⤵
PID:4296