yunsip | d74d8429a9ad479607285b777e7ce1e97996f1672175c294724344e6cfcb3bba | Triage

Analysis

max time kernel
39s
max time network
42s
platform
windows7_x64
resource
win7v20201028
submitted
08-11-2020 18:03

Sharing

Report Analysis Logs

General

Target

d74d8429a9ad479607285b777e7ce1e97996f1672175c294724344e6cfcb3bba.dll
Size

715KB
MD5

3111cb24728e961cfaf994eeeaaf97df
SHA1

f8f5685529f62a0508b2a0bd5d5eee6f99da8c6a
SHA256

d74d8429a9ad479607285b777e7ce1e97996f1672175c294724344e6cfcb3bba
SHA512

ac69dbfe860b5bcf643365b666ada3ec65c6ee0c25e2313d45a17f331d42601b4ae743bd77b99075f4ce9e8be53582d0dfdfe3bae4327c218f3d6d7e8acd0730

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 344 wrote to memory of 1596	344	rundll32.exe	rundll32.exe
PID 344 wrote to memory of 1596	344	rundll32.exe	rundll32.exe
PID 344 wrote to memory of 1596	344	rundll32.exe	rundll32.exe
PID 344 wrote to memory of 1596	344	rundll32.exe	rundll32.exe
PID 344 wrote to memory of 1596	344	rundll32.exe	rundll32.exe
PID 344 wrote to memory of 1596	344	rundll32.exe	rundll32.exe
PID 344 wrote to memory of 1596	344	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d74d8429a9ad479607285b777e7ce1e97996f1672175c294724344e6cfcb3bba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d74d8429a9ad479607285b777e7ce1e97996f1672175c294724344e6cfcb3bba.dll,#1
2⤵
PID:1596

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-0-0x0000000000000000-mapping.dmp

Download