yunsip | f77b32aa1887057c2259aada167fa2c110e36833d7a1bb9e44c395febd23d5c9 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7v20210410
submitted
18-05-2021 10:05

Sharing

Report Analysis Logs

General

Target

f77b32aa1887057c2259aada167fa2c110e36833d7a1bb9e44c395febd23d5c9.dll
Size

1016KB
MD5

a73a5cbe89dabbb429a86d01e1a5b8ef
SHA1

15cf376cc3a4ccfaea9cde87d59ac6bd1c2e0db6
SHA256

f77b32aa1887057c2259aada167fa2c110e36833d7a1bb9e44c395febd23d5c9
SHA512

5a8d5ebc4d59517f0e127d94208012ca58627f13576f5bf7f582df6eba4b560f08fb39da32a2ddcc3beff3493081ab9546e80db7d439fb4b1a0325b2fe1f6a63

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1104 wrote to memory of 1632	1104	rundll32.exe	rundll32.exe
PID 1104 wrote to memory of 1632	1104	rundll32.exe	rundll32.exe
PID 1104 wrote to memory of 1632	1104	rundll32.exe	rundll32.exe
PID 1104 wrote to memory of 1632	1104	rundll32.exe	rundll32.exe
PID 1104 wrote to memory of 1632	1104	rundll32.exe	rundll32.exe
PID 1104 wrote to memory of 1632	1104	rundll32.exe	rundll32.exe
PID 1104 wrote to memory of 1632	1104	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f77b32aa1887057c2259aada167fa2c110e36833d7a1bb9e44c395febd23d5c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f77b32aa1887057c2259aada167fa2c110e36833d7a1bb9e44c395febd23d5c9.dll,#1
2⤵
PID:1632

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-59-0x0000000000000000-mapping.dmp

Download
memory/1632-60-0x0000000076E11000-0x0000000076E13000-memory.dmp

Filesize
8KB

Download