yunsip | a89c3593daee8f32712f600f18369b61263db7661b7848e9adfe08174310e0ad | Triage

Analysis

max time kernel
141s
max time network
143s
platform
windows10_x64
resource
win10v20210410
submitted
18-05-2021 10:03

Sharing

Report Analysis Logs

General

Target

a89c3593daee8f32712f600f18369b61263db7661b7848e9adfe08174310e0ad.dll
Size

726KB
MD5

7b30700b4b44885d7440c47016447384
SHA1

781064ce6af4d9ccbaf1263ceb2fb0fbaeacc44a
SHA256

a89c3593daee8f32712f600f18369b61263db7661b7848e9adfe08174310e0ad
SHA512

4ba9c996c192a7b171b1c0a8f970bbf313c3525f62e1a6c4cbc45c95390f4572a4d347aa1fd4953f323c01443baa684d6bba33b2cf77ca2f5ba2245fa94877fd

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2116 wrote to memory of 3216	2116	rundll32.exe	rundll32.exe
PID 2116 wrote to memory of 3216	2116	rundll32.exe	rundll32.exe
PID 2116 wrote to memory of 3216	2116	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a89c3593daee8f32712f600f18369b61263db7661b7848e9adfe08174310e0ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a89c3593daee8f32712f600f18369b61263db7661b7848e9adfe08174310e0ad.dll,#1
2⤵
PID:3216

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3216-114-0x0000000000000000-mapping.dmp

Download