yunsip | 5f767cfe2f3ff16b27bff0a8ba70e48af8a1d51ffe70acde43b2d79389a87cf6

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 06:50

Target

5f767cfe2f3ff16b27bff0a8ba70e48af8a1d51ffe70acde43b2d79389a87cf6_NeikiAnalytics.dll
Size

1.0MB
MD5

9429e72d82e6a9797a6492f8ec4314d0
SHA1

0531afe2081fb5e53d429e4f62a558005c87f9bd
SHA256

5f767cfe2f3ff16b27bff0a8ba70e48af8a1d51ffe70acde43b2d79389a87cf6
SHA512

2b3c82eaaa4d6f6d0dd4835ce8f5592c07eb27dd085b7539e8c3fc19d0fde1da0d0c338a495cab43ca5f60b14b72a74d611a434142a305f0a1d577410db4546f
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY6:o6RI1Fo/wT3cJYYYYYYYYYYYY6

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1460 wrote to memory of 1456	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 1456	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 1456	1460	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f767cfe2f3ff16b27bff0a8ba70e48af8a1d51ffe70acde43b2d79389a87cf6_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f767cfe2f3ff16b27bff0a8ba70e48af8a1d51ffe70acde43b2d79389a87cf6_NeikiAnalytics.dll,#1
2⤵
PID:1456