yunsip | c822a4ce6bbad6d9e3f25777f8b4a46bc263da91771f27d5c8310269676440ef | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows10_x64
resource
win10v20210410
submitted
18-05-2021 11:10

Sharing

Report Analysis Logs

General

Target

c822a4ce6bbad6d9e3f25777f8b4a46bc263da91771f27d5c8310269676440ef.dll
Size

454KB
MD5

50259c1b67b3ffd1486e4b6c0163efcd
SHA1

46695ecedd48e987e563e18e865d9501bddeaf95
SHA256

c822a4ce6bbad6d9e3f25777f8b4a46bc263da91771f27d5c8310269676440ef
SHA512

7933955a8acdd33f4df42aa28d7acb858ecac84d9d8629a07be67cc3174cb0aa053956dde985c1460cfebf5f6ec168618be0e4aa5507ada5ee2cf1913188ded7

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 512 wrote to memory of 4040	512	rundll32.exe	rundll32.exe
PID 512 wrote to memory of 4040	512	rundll32.exe	rundll32.exe
PID 512 wrote to memory of 4040	512	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c822a4ce6bbad6d9e3f25777f8b4a46bc263da91771f27d5c8310269676440ef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:512

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c822a4ce6bbad6d9e3f25777f8b4a46bc263da91771f27d5c8310269676440ef.dll,#1
2⤵
PID:4040

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4040-114-0x0000000000000000-mapping.dmp

Download