yunsip | 235997a730c082f9f59860516ea46aaed71fd3e8227f7b2471abdf80e0971972 | Triage

Analysis

max time kernel
3s
max time network
9s
platform
windows7_x64
resource
win7v20201028
submitted
08-11-2020 18:01

Sharing

Report Analysis Logs

General

Target

235997a730c082f9f59860516ea46aaed71fd3e8227f7b2471abdf80e0971972.dll
Size

714KB
MD5

aaa4edfe011c8d2cdbb02bbb31282bc6
SHA1

b1adf2f2d46df98bc604aa54d9443a9479abd065
SHA256

235997a730c082f9f59860516ea46aaed71fd3e8227f7b2471abdf80e0971972
SHA512

3f1a5f729dbade826fc7aa246d5393b7560ae0ab1aa1a175e01d777da6838c609f5e4e6c730198acb7059426bfaa11e128208ed921392481fc2488dc03aefc48

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1012 wrote to memory of 1368	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 1368	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 1368	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 1368	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 1368	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 1368	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 1368	1012	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\235997a730c082f9f59860516ea46aaed71fd3e8227f7b2471abdf80e0971972.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\235997a730c082f9f59860516ea46aaed71fd3e8227f7b2471abdf80e0971972.dll,#1
2⤵
PID:1368

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-0-0x0000000000000000-mapping.dmp

Download