yunsip | 61bf91f08bce264cb513a8b99c050064bd2f6fbdd8e18f1a8d66ae94bdacfd04 | Triage

Analysis

max time kernel
39s
max time network
136s
platform
windows10_x64
resource
win10v20210408
submitted
18-05-2021 08:14

Sharing

Report Analysis Logs

General

Target

61bf91f08bce264cb513a8b99c050064bd2f6fbdd8e18f1a8d66ae94bdacfd04.dll
Size

446KB
MD5

b6512cd6641618fb0703ea17306a709c
SHA1

43dbf4dffb2c0b3309973c1ff314f3783692e2d6
SHA256

61bf91f08bce264cb513a8b99c050064bd2f6fbdd8e18f1a8d66ae94bdacfd04
SHA512

bea404fc7ff11d88f40a13c58d5c38af5450a90455abd3634d83442383e0dbb21aa867f44b3ae4a75bd708d87cca63b5a0938f9d73b454f6bab824d6f6620d92

Score

10^/10

yunsip banker trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4656 wrote to memory of 4700	4656	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 4700	4656	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 4700	4656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61bf91f08bce264cb513a8b99c050064bd2f6fbdd8e18f1a8d66ae94bdacfd04.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61bf91f08bce264cb513a8b99c050064bd2f6fbdd8e18f1a8d66ae94bdacfd04.dll,#1
2⤵
PID:4700

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4700-114-0x0000000000000000-mapping.dmp

Download