yunsip | 8e3bd7379c9e31f61640330b22152d0fc2b0dd1da12612edc04583adbed6833d

Analysis

max time kernel
93s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2025, 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e3bd7379c9e31f61640330b22152d0fc2b0dd1da12612edc04583adbed6833d.dll
Size

678KB
MD5

6d734a1ba7d2f80aac7eb08de94752eb
SHA1

38e07d124ff12ce7c71d510a12a98584f560d572
SHA256

8e3bd7379c9e31f61640330b22152d0fc2b0dd1da12612edc04583adbed6833d
SHA512

9648a01438be9fa7bb351a46047144ef052e40a3de307397e2b53b871633b167815f90a7fe42c794c148640cec43103ca953aaa032c76378421e125020344a86
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYf:o6RI1Fo/wT3cJYYYYYYYYYYYYf

Score

10^/10

yunsip banker discovery trojan

Malware Config

Signatures

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip
Yunsip family
yunsip

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 5108	456	rundll32.exe	84
PID 456 wrote to memory of 5108	456	rundll32.exe	84
PID 456 wrote to memory of 5108	456	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e3bd7379c9e31f61640330b22152d0fc2b0dd1da12612edc04583adbed6833d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e3bd7379c9e31f61640330b22152d0fc2b0dd1da12612edc04583adbed6833d.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...