yunsip | e0709c18168ad1f3e8bb3248a72cf8c60afabd21840386487adbef123a5d6deb | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
08-11-2020 18:02

Sharing

Report Analysis Logs

General

Target

e0709c18168ad1f3e8bb3248a72cf8c60afabd21840386487adbef123a5d6deb.dll
Size

688KB
MD5

d21daa8e220953b38a63dcf97fd283f5
SHA1

8965273c2d3d7157a731086ee61a3ae6166f2dc5
SHA256

e0709c18168ad1f3e8bb3248a72cf8c60afabd21840386487adbef123a5d6deb
SHA512

7dc696af0dcbcb946135c99f5b9910c789e8a512ce2303317fd257e00c1f81d67b693c1a948c1efa462a4fb8375c0da9009ebffb6bfd86cb48726725d2994ef0

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 640 wrote to memory of 956	640	rundll32.exe	rundll32.exe
PID 640 wrote to memory of 956	640	rundll32.exe	rundll32.exe
PID 640 wrote to memory of 956	640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0709c18168ad1f3e8bb3248a72cf8c60afabd21840386487adbef123a5d6deb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0709c18168ad1f3e8bb3248a72cf8c60afabd21840386487adbef123a5d6deb.dll,#1
2⤵
PID:956

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-0-0x0000000000000000-mapping.dmp

Download