yunsip | 45d4aab97ff372606c7664978277e7eae6ffe6fd47b8f6ce92f96d9038684f7a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 01:32

Target

45d4aab97ff372606c7664978277e7eae6ffe6fd47b8f6ce92f96d9038684f7a_NeikiAnalytics.dll
Size

1.1MB
MD5

e6d6f750d9294cd5b361cad6d5a75d90
SHA1

d3d88ada5c6845623b64ebfec17c604f9ffab190
SHA256

45d4aab97ff372606c7664978277e7eae6ffe6fd47b8f6ce92f96d9038684f7a
SHA512

40dff7a965f894fb7d254b74ea44a8d3d5a9dc08e679ca9dc93dbce62b884a6984b116de654c1ad573b0e433ae3b665afe0688357e428a1e6cdf8994aca06e17
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY/:o6RI1Fo/wT3cJYYYYYYYYYYYY/

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4528 wrote to memory of 1284	4528	rundll32.exe	rundll32.exe
PID 4528 wrote to memory of 1284	4528	rundll32.exe	rundll32.exe
PID 4528 wrote to memory of 1284	4528	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d4aab97ff372606c7664978277e7eae6ffe6fd47b8f6ce92f96d9038684f7a_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d4aab97ff372606c7664978277e7eae6ffe6fd47b8f6ce92f96d9038684f7a_NeikiAnalytics.dll,#1
  2⤵
  PID:1284