yunsip | d74d8429a9ad479607285b777e7ce1e97996f1672175c294724344e6cfcb3bba | Triage™

Analysis

max time kernel
123s
max time network
125s
platform
windows10_x64
resource
win10v20201028
submitted
08/11/2020, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d74d8429a9ad479607285b777e7ce1e97996f1672175c294724344e6cfcb3bba.dll
Size 715KB
Sample201108-mq246pyfk6
SHA256 d74d8429a9ad479607285b777e7ce1e97996f1672175c294724344e6cfcb3bba
MD5 3111cb24728e961cfaf994eeeaaf97df
SHA1 f8f5685529f62a0508b2a0bd5d5eee6f99da8c6a
SHA512 ac69dbfe860b5bcf643365b666ada3ec65c6ee0c25e2313d45a17f331d42601b4ae743bd77b99075f4ce9e8be53582d0dfdfe3bae4327c218f3d6d7e8acd0730
MD5 SHA1 SHA512

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1136	632	rundll32.exe	69
PID 632 wrote to memory of 1136	632	rundll32.exe	69
PID 632 wrote to memory of 1136	632	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d74d8429a9ad479607285b777e7ce1e97996f1672175c294724344e6cfcb3bba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d74d8429a9ad479607285b777e7ce1e97996f1672175c294724344e6cfcb3bba.dll,#1
  2⤵
  PID:1136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads