yunsip | 0925797913e5a45dcfa4e6c2265c86cc74ae2e0dce003ccd26f8281e4d216c83

Analysis

max time kernel
93s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 17:31

Target

0925797913e5a45dcfa4e6c2265c86cc74ae2e0dce003ccd26f8281e4d216c83_NeikiAnalytics.dll
Size

617KB
MD5

0f7ad524c6f28ee87b7cf3298d2a48b0
SHA1

6fbf1e7732748da99b487e35cacbb012f18bc601
SHA256

0925797913e5a45dcfa4e6c2265c86cc74ae2e0dce003ccd26f8281e4d216c83
SHA512

a912892c389f317b99d82bc7b9c45396cc68f1a73f7752afd9300a517732d85a98ece8fdae1987d443f3f13f5ae7d6d97f6f282cbeb49395137eeaecc7d786f4
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYZ:o6RI1Fo/wT3cJYYYYYYYYYYYYZ

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 536 wrote to memory of 1620	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1620	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1620	536	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0925797913e5a45dcfa4e6c2265c86cc74ae2e0dce003ccd26f8281e4d216c83_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0925797913e5a45dcfa4e6c2265c86cc74ae2e0dce003ccd26f8281e4d216c83_NeikiAnalytics.dll,#1
2⤵
PID:1620