yunsip | 632af5dd73e27466cabc70af4338d8d7b16f0d13de9cc59dd701bc32da9c5cc3 | Triage

Analysis

max time kernel
148s
max time network
149s
platform
windows10_x64
resource
win10v20210410
submitted
18-05-2021 11:28

Sharing

Report Analysis Logs

General

Target

632af5dd73e27466cabc70af4338d8d7b16f0d13de9cc59dd701bc32da9c5cc3.dll
Size

1003KB
MD5

554f5643359cb61a48756b09e1562f92
SHA1

b7e16d96a7e67d17e2725093a15247454d8aaab5
SHA256

632af5dd73e27466cabc70af4338d8d7b16f0d13de9cc59dd701bc32da9c5cc3
SHA512

49b79ede2300a08bbd8a36c4edacc79dd4916095e4b17900ff78043a2162cafd358d4fd81059f5e6bb1e81871a46659d6d78ee97d646c9fe3342ddada0f89e94

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3172 wrote to memory of 3184	3172	rundll32.exe	rundll32.exe
PID 3172 wrote to memory of 3184	3172	rundll32.exe	rundll32.exe
PID 3172 wrote to memory of 3184	3172	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\632af5dd73e27466cabc70af4338d8d7b16f0d13de9cc59dd701bc32da9c5cc3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3172

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\632af5dd73e27466cabc70af4338d8d7b16f0d13de9cc59dd701bc32da9c5cc3.dll,#1
2⤵
PID:3184

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3184-114-0x0000000000000000-mapping.dmp

Download