yunsip | 16810cedf2031347d3fcab9965892e07c9705237f3b43bbce520cc6a44d58756 | Triage

Analysis

max time kernel
3s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
08-11-2020 17:57

Sharing

Report Analysis Logs

General

Target

16810cedf2031347d3fcab9965892e07c9705237f3b43bbce520cc6a44d58756.dll
Size

734KB
MD5

c0273044f0f16afa626bf0155c8edafc
SHA1

1d22144caeec532b6cc3d02ecfe504a5b937b189
SHA256

16810cedf2031347d3fcab9965892e07c9705237f3b43bbce520cc6a44d58756
SHA512

8028322e912eebd816aa76ca30a6635bd47cd6a63c2e11847fd0619a6b2290765d66ad3aaa97f449bb70eac0ef2df7e6d75d1f4b3ab10ab69d1b7011b02db7e1

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2036 wrote to memory of 1544	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1544	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1544	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1544	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1544	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1544	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1544	2036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16810cedf2031347d3fcab9965892e07c9705237f3b43bbce520cc6a44d58756.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16810cedf2031347d3fcab9965892e07c9705237f3b43bbce520cc6a44d58756.dll,#1
2⤵
PID:1544

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-0-0x0000000000000000-mapping.dmp

Download