yunsip | e7afd6e83e2191b945771eeaf4915a865ff4f0a704bf8cfa4395f60466eba645 | Triage

Analysis

max time kernel
3s
max time network
13s
platform
windows7_x64
resource
win7v20210410
submitted
18-05-2021 12:44

Sharing

Report Analysis Logs

General

Target

e7afd6e83e2191b945771eeaf4915a865ff4f0a704bf8cfa4395f60466eba645.dll
Size

725KB
MD5

8b604e09fdbae6bb46e682dd68fe9fc3
SHA1

7372fffe22d5c048d63627a513f334525ece0dcc
SHA256

e7afd6e83e2191b945771eeaf4915a865ff4f0a704bf8cfa4395f60466eba645
SHA512

1d0adaf8ca4f79b473f9e8e71bda1e7a953729d0b32f4b6a9cde655936fe0d021d50ee1cdad199d7107803678339c7aa7a6968ddf62604b50f8358b0ba1eb3d9

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2004 wrote to memory of 1464	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1464	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1464	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1464	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1464	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1464	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1464	2004	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7afd6e83e2191b945771eeaf4915a865ff4f0a704bf8cfa4395f60466eba645.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7afd6e83e2191b945771eeaf4915a865ff4f0a704bf8cfa4395f60466eba645.dll,#1
2⤵
PID:1464

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-60-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/1464-59-0x0000000000000000-mapping.dmp

Download