yunsip | 0d66f469f00e0fed3154faa00ef3b75e74a53811e192a11e461d13121a5c9602 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10_x64
resource
win10v20210410
submitted
13-05-2021 02:02

Sharing

Report Analysis Logs

General

Target

0d66f469f00e0fed3154faa00ef3b75e74a53811e192a11e461d13121a5c9602.dll
Size

636KB
MD5

0c613a0c160d864adccf78edcc5a0239
SHA1

4e3150debd8f24c593aab99b0043673a7b1374ac
SHA256

0d66f469f00e0fed3154faa00ef3b75e74a53811e192a11e461d13121a5c9602
SHA512

dd71f44b017cc8fcfcf7219318fb994cbef3f47f3d20d47d13d13826243bf497fc8b71b8ffe258968ddeb3053d5615f0ddd44f81f63ed8fa8962b27e697c300b

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2016 wrote to memory of 3692	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 3692	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 3692	2016	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d66f469f00e0fed3154faa00ef3b75e74a53811e192a11e461d13121a5c9602.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d66f469f00e0fed3154faa00ef3b75e74a53811e192a11e461d13121a5c9602.dll,#1
2⤵
PID:3692

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3692-114-0x0000000000000000-mapping.dmp

Download