yunsip | 5f787fe2b630dd9239ac685d11c9685aa719bb48c12e80813eb6063de89b1f1c | Triage

Analysis

max time kernel
123s
max time network
125s
platform
windows7_x64
resource
win7v20201028
submitted
08-11-2020 18:16

Sharing

Report Analysis Logs

General

Target

5f787fe2b630dd9239ac685d11c9685aa719bb48c12e80813eb6063de89b1f1c.dll
Size

715KB
MD5

72e06136c6902f4e656627caa4831970
SHA1

51eb1d9b2cfb013b5579cf67180c6d9810ee920d
SHA256

5f787fe2b630dd9239ac685d11c9685aa719bb48c12e80813eb6063de89b1f1c
SHA512

c68beca929aa67e453e8e3541e5a66f55258e1ccb564c875176bbb6b7b303815b9571d78587a08299e2e778b50ebfb9e4a571b4493fb66f9b2c469369d2bb392

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 484 wrote to memory of 1924	484	rundll32.exe	rundll32.exe
PID 484 wrote to memory of 1924	484	rundll32.exe	rundll32.exe
PID 484 wrote to memory of 1924	484	rundll32.exe	rundll32.exe
PID 484 wrote to memory of 1924	484	rundll32.exe	rundll32.exe
PID 484 wrote to memory of 1924	484	rundll32.exe	rundll32.exe
PID 484 wrote to memory of 1924	484	rundll32.exe	rundll32.exe
PID 484 wrote to memory of 1924	484	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f787fe2b630dd9239ac685d11c9685aa719bb48c12e80813eb6063de89b1f1c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:484

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f787fe2b630dd9239ac685d11c9685aa719bb48c12e80813eb6063de89b1f1c.dll,#1
2⤵
PID:1924

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-0-0x0000000000000000-mapping.dmp

Download