yunsip | 5295bcbbb3f9953e42ce7fba08b95f0c99defda0a17737aca80acac05df76d34 | Triage

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7v20201028
submitted
17-11-2020 12:13

Sharing

Report Analysis Logs

General

Target

3e9e1ad568b7abfd4b5e0ba892132e3e.dll
Size

425KB
MD5

6baa02ace14e508b7df181df3043e8cf
SHA1

7eb0937bac85f15ab270379fa7c1b5a0dbf2a5fc
SHA256

5295bcbbb3f9953e42ce7fba08b95f0c99defda0a17737aca80acac05df76d34
SHA512

d25fb43923d420b9f68147612b3d77192921e2671f68b6a7bee78f4200766eb32b171915762035b7b94b078e93163c64dde8cc72d2ea06ac907d06c1b087acfc

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1848 wrote to memory of 1236	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 1236	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 1236	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 1236	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 1236	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 1236	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 1236	1848	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e9e1ad568b7abfd4b5e0ba892132e3e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e9e1ad568b7abfd4b5e0ba892132e3e.dll,#1
2⤵
PID:1236

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-0-0x0000000000000000-mapping.dmp

Download