yunsip | ae631723a338ffec7abec6d649a0705b6cdd01708715fb1952405cb7753008a4 | Triage

Analysis

max time kernel
13s
max time network
111s
platform
windows10_x64
resource
win10v20210410
submitted
18-05-2021 10:01

Sharing

Report Analysis Logs

General

Target

ae631723a338ffec7abec6d649a0705b6cdd01708715fb1952405cb7753008a4.dll
Size

444KB
MD5

ffeb04ef1e9af02d911c1570ed85228c
SHA1

c9d63edf928c71233f2e308ea85b173fd8b82f5d
SHA256

ae631723a338ffec7abec6d649a0705b6cdd01708715fb1952405cb7753008a4
SHA512

46e547d908e32e4bcb6c11057167ba76a980651baa31da027c8760d19c5441e7627371b2caf25f96d2af56915318efb9b085b628f7d2ae8743a2ed430c01b531

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3424 wrote to memory of 3972	3424	rundll32.exe	rundll32.exe
PID 3424 wrote to memory of 3972	3424	rundll32.exe	rundll32.exe
PID 3424 wrote to memory of 3972	3424	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae631723a338ffec7abec6d649a0705b6cdd01708715fb1952405cb7753008a4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae631723a338ffec7abec6d649a0705b6cdd01708715fb1952405cb7753008a4.dll,#1
2⤵
PID:3972

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3972-114-0x0000000000000000-mapping.dmp

Download