yunsip | f06c3981baa23da5ae31e30e3de8286d32494edff3a3870803585857b8c56929 | Triage

Analysis

max time kernel
148s
max time network
152s
platform
windows10_x64
resource
win10v20210410
submitted
18-05-2021 12:03

Sharing

Report Analysis Logs

General

Target

f06c3981baa23da5ae31e30e3de8286d32494edff3a3870803585857b8c56929.dll
Size

451KB
MD5

8698dd3ce1311419353e586c4b7e74c8
SHA1

39cc9576cc8661e12735f81f53dc951f98ce693c
SHA256

f06c3981baa23da5ae31e30e3de8286d32494edff3a3870803585857b8c56929
SHA512

d82007171959b273454c291a21f016527be7eb96a894f8b4168e73bcb980d84fa7c0bf2657a72a6e3ff185cf178cdb794417bd2e3d604dab45579df1aca8e78c

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3092 wrote to memory of 3408	3092	rundll32.exe	rundll32.exe
PID 3092 wrote to memory of 3408	3092	rundll32.exe	rundll32.exe
PID 3092 wrote to memory of 3408	3092	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f06c3981baa23da5ae31e30e3de8286d32494edff3a3870803585857b8c56929.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3092

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f06c3981baa23da5ae31e30e3de8286d32494edff3a3870803585857b8c56929.dll,#1
2⤵
PID:3408

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3408-114-0x0000000000000000-mapping.dmp

Download