yunsip | 45d4aab97ff372606c7664978277e7eae6ffe6fd47b8f6ce92f96d9038684f7a

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 01:32

Target

45d4aab97ff372606c7664978277e7eae6ffe6fd47b8f6ce92f96d9038684f7a_NeikiAnalytics.dll
Size

1.1MB
MD5

e6d6f750d9294cd5b361cad6d5a75d90
SHA1

d3d88ada5c6845623b64ebfec17c604f9ffab190
SHA256

45d4aab97ff372606c7664978277e7eae6ffe6fd47b8f6ce92f96d9038684f7a
SHA512

40dff7a965f894fb7d254b74ea44a8d3d5a9dc08e679ca9dc93dbce62b884a6984b116de654c1ad573b0e433ae3b665afe0688357e428a1e6cdf8994aca06e17
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY/:o6RI1Fo/wT3cJYYYYYYYYYYYY/

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2236	2412	rundll32.exe	28
PID 2412 wrote to memory of 2236	2412	rundll32.exe	28
PID 2412 wrote to memory of 2236	2412	rundll32.exe	28
PID 2412 wrote to memory of 2236	2412	rundll32.exe	28
PID 2412 wrote to memory of 2236	2412	rundll32.exe	28
PID 2412 wrote to memory of 2236	2412	rundll32.exe	28
PID 2412 wrote to memory of 2236	2412	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d4aab97ff372606c7664978277e7eae6ffe6fd47b8f6ce92f96d9038684f7a_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d4aab97ff372606c7664978277e7eae6ffe6fd47b8f6ce92f96d9038684f7a_NeikiAnalytics.dll,#1
  2⤵
  PID:2236