yunsip | 9bf06804f07800715d2d13705b412647973e621b9512005f0bdd6a553c25b4ba | Triage

Analysis

max time kernel
26s
max time network
29s
platform
windows7_x64
resource
win7v20201028
submitted
08-11-2020 18:17

Sharing

Report Analysis Logs

General

Target

9bf06804f07800715d2d13705b412647973e621b9512005f0bdd6a553c25b4ba.dll
Size

657KB
MD5

c67c4abe4a8b185799329c4500b2b5a3
SHA1

f380a8cdeb388bec7735ea7232c405e61f6f79f4
SHA256

9bf06804f07800715d2d13705b412647973e621b9512005f0bdd6a553c25b4ba
SHA512

064c2bc04a6ef7a1c8131d05b30e119097beea8c88ae83d750d06a2c9ab62c85ee27b22bba103b5c580a5f1b5a81fa8f657dab34d5f996d4bdbc7ebc187f8781

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 684 wrote to memory of 1832	684	rundll32.exe	rundll32.exe
PID 684 wrote to memory of 1832	684	rundll32.exe	rundll32.exe
PID 684 wrote to memory of 1832	684	rundll32.exe	rundll32.exe
PID 684 wrote to memory of 1832	684	rundll32.exe	rundll32.exe
PID 684 wrote to memory of 1832	684	rundll32.exe	rundll32.exe
PID 684 wrote to memory of 1832	684	rundll32.exe	rundll32.exe
PID 684 wrote to memory of 1832	684	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bf06804f07800715d2d13705b412647973e621b9512005f0bdd6a553c25b4ba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bf06804f07800715d2d13705b412647973e621b9512005f0bdd6a553c25b4ba.dll,#1
2⤵
PID:1832

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-0-0x0000000000000000-mapping.dmp

Download