yunsip | 1b2280c672a0c67cff768f8db2ac4e004a1fec372b005d87b1f1f1fa4429fb32 | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10_x64
resource
win10v20201028
submitted
08-11-2020 18:04

Sharing

Report Analysis Logs

General

Target

1b2280c672a0c67cff768f8db2ac4e004a1fec372b005d87b1f1f1fa4429fb32.dll
Size

723KB
MD5

4813c799f7b4fb4d0f2f152fe923e1a3
SHA1

9945a97fe1e190ac51489cef4aa1f6e30dee2614
SHA256

1b2280c672a0c67cff768f8db2ac4e004a1fec372b005d87b1f1f1fa4429fb32
SHA512

c2d01ba085602e19917dae32f6b9f50ded19083cf93b03651c1dfd01cb7b10423db40bd155d31b3010b3bdb5416b48f7a33e2afc3bfc9050a98dcf0dac73ca9e

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 492 wrote to memory of 1320	492	rundll32.exe	rundll32.exe
PID 492 wrote to memory of 1320	492	rundll32.exe	rundll32.exe
PID 492 wrote to memory of 1320	492	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b2280c672a0c67cff768f8db2ac4e004a1fec372b005d87b1f1f1fa4429fb32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:492

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b2280c672a0c67cff768f8db2ac4e004a1fec372b005d87b1f1f1fa4429fb32.dll,#1
2⤵
PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-0-0x0000000000000000-mapping.dmp

Download