yunsip | 57430d1f5d3b5d233e75ade174a56dc50812f9137af575bcf882c3ce3b39b5a5 | Triage

Analysis

max time kernel
11s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
08-11-2020 18:01

Sharing

Report Analysis Logs

General

Target

57430d1f5d3b5d233e75ade174a56dc50812f9137af575bcf882c3ce3b39b5a5.dll
Size

733KB
MD5

795392ae104600855f46e7b910ee32e0
SHA1

2e5d5ff752a64aa1377288725204c0af8d47b0ca
SHA256

57430d1f5d3b5d233e75ade174a56dc50812f9137af575bcf882c3ce3b39b5a5
SHA512

83ba3b867778a08c62e3f560c47f0154a9552f32a2ac6ba8c527fc2be8fe777db6149fd19caf2f39d2e8adb896bf88f37bd1f8e404a43c1994db61ff440462af

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 744 wrote to memory of 3628	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 3628	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 3628	744	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57430d1f5d3b5d233e75ade174a56dc50812f9137af575bcf882c3ce3b39b5a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57430d1f5d3b5d233e75ade174a56dc50812f9137af575bcf882c3ce3b39b5a5.dll,#1
2⤵
PID:3628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3628-0-0x0000000000000000-mapping.dmp

Download