yunsip | b13e46ed17e3163718ccc198988bfd87a46496d404c2d9a4ccffe8aeafc3bb8d | Triage

Analysis

max time kernel
12s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
08-11-2020 17:54

Sharing

Report Analysis Logs

General

Target

b13e46ed17e3163718ccc198988bfd87a46496d404c2d9a4ccffe8aeafc3bb8d.dll
Size

2.6MB
MD5

c05033bcc31094285e377acd7649c5c4
SHA1

354dd6f09252a096ca8f78339dfd7959e0e2cfbd
SHA256

b13e46ed17e3163718ccc198988bfd87a46496d404c2d9a4ccffe8aeafc3bb8d
SHA512

3232eb835f666f834684e7f44aa8108fbe76681856997bf783add4dbba01ffd1aa26064d50b889de925820b79aee7680fb57d97fbb325d800c8312abc4dfc8bb

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1048 wrote to memory of 1672	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 1672	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 1672	1048	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b13e46ed17e3163718ccc198988bfd87a46496d404c2d9a4ccffe8aeafc3bb8d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b13e46ed17e3163718ccc198988bfd87a46496d404c2d9a4ccffe8aeafc3bb8d.dll,#1
2⤵
PID:1672

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-0-0x0000000000000000-mapping.dmp

Download