yunsip | 03bcdc7cde3039a71ed864ec79406605311861d51b7a7c7bf3578ac622d6874b | Triage

Analysis

max time kernel
26s
max time network
135s
platform
windows10_x64
resource
win10v20210408
submitted
18-05-2021 11:13

Sharing

Report Analysis Logs

General

Target

03bcdc7cde3039a71ed864ec79406605311861d51b7a7c7bf3578ac622d6874b.dll
Size

678KB
MD5

a6cc3059382dc049e763b54f46bc6a82
SHA1

9a99b5061b84f7a36d2ab4e88d724fd2af6c1bd0
SHA256

03bcdc7cde3039a71ed864ec79406605311861d51b7a7c7bf3578ac622d6874b
SHA512

8e19f6f66db6d52e83f0f44ef883c24a7d558a96edad467e5eb8d6c366dbce46438e0f2821a207c180f059b2aaa664c68cc43391527f4998ca1f50310f29c6ae

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 408 wrote to memory of 3272	408	rundll32.exe	rundll32.exe
PID 408 wrote to memory of 3272	408	rundll32.exe	rundll32.exe
PID 408 wrote to memory of 3272	408	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03bcdc7cde3039a71ed864ec79406605311861d51b7a7c7bf3578ac622d6874b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:408

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03bcdc7cde3039a71ed864ec79406605311861d51b7a7c7bf3578ac622d6874b.dll,#1
2⤵
PID:3272

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3272-114-0x0000000000000000-mapping.dmp

Download