yunsip | 946757b2158eae8c8fa8ba35686a2c07788aa23f455939d7b61e99828a107301 | Triage

Analysis

max time kernel
49s
max time network
71s
platform
windows10_x64
resource
win10v20210408
submitted
18-05-2021 10:46

Sharing

Report Analysis Logs

General

Target

946757b2158eae8c8fa8ba35686a2c07788aa23f455939d7b61e99828a107301.dll
Size

1020KB
MD5

a1ef974d3255e7d0775690112342aeee
SHA1

e1b7a5a498542faecea2cbb470ab682654d140c3
SHA256

946757b2158eae8c8fa8ba35686a2c07788aa23f455939d7b61e99828a107301
SHA512

e7cf618f9a7871d6a8cea29a4d452a6d719d8572b0b53f61e2406dc856ddfd1b22ec42f58921b191d40c4f9b4436181cbb9ba1676cc8aa3f0365ffb97ecad2a8

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 672 wrote to memory of 3996	672	rundll32.exe	rundll32.exe
PID 672 wrote to memory of 3996	672	rundll32.exe	rundll32.exe
PID 672 wrote to memory of 3996	672	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\946757b2158eae8c8fa8ba35686a2c07788aa23f455939d7b61e99828a107301.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\946757b2158eae8c8fa8ba35686a2c07788aa23f455939d7b61e99828a107301.dll,#1
2⤵
PID:3996

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3996-114-0x0000000000000000-mapping.dmp

Download