Overview

overview

10

Static

static

1

TeraBox_sl....6.exe

windows7-x64

10

TeraBox_sl....6.exe

windows10-2004-x64

4

Resubmissions

13-07-2023 14:11

230713-rhjblahh5t 1

03-07-2023 17:25

230703-vy9p9sag31 10

Analysis

  • max time kernel
    22s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-07-2023 17:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TeraBox_sl_b_1.20.0.6.exe

  • Size

    84.4MB

  • MD5

    add481fdab5622f0bed9624d0da23bb0

  • SHA1

    9b2ec5159aec9b270fc89b9050ad7b405793bf53

  • SHA256

    a1fb6802f684d5bd1228000987e88bb7bd6ae3230d7b4416466f8585a53d5e49

  • SHA512

    6365891e241679e024e2514ca32a36baacaeaa52c3b2de8a07b6db76c8eb1d40c41061ccd26a6d24bcdabae9ad14552f1bfef54dc3f0f26bc116ca9fd7082577

  • SSDEEP

    1572864:IddPxMVHjdsnIUnVCnvO9cHC/yp3IsxyCUgd/1l5ueG2+q7WgNaWN:6odZUn20cHCmFZtG2+tuzN

Score
4/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.20.0.6.exe
    "C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.20.0.6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:4856

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsm7F82.tmp\NsisInstallUI.dll
    Filesize

    2.1MB

    MD5

    70fba8a580e94fa8753fa71cd7703d5b

    SHA1

    57817a035649ed0cfb9087cb908a16bd2c8b2ddb

    SHA256

    98756e3b2a2a7bcc8933da9f0fe7ed29dbefa315a1192d0426d039b320965eea

    SHA512

    9d5c166877f427b797435939f09e5c7904dd2e8d0a36297ad22de0581435fcd53e14b6855c646c4124de332a119d8619c34ce3e657493bd73114e1bc8448207c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsm7F82.tmp\System.dll
    Filesize

    12KB

    MD5

    8cf2ac271d7679b1d68eefc1ae0c5618

    SHA1

    7cc1caaa747ee16dc894a600a4256f64fa65a9b8

    SHA256

    6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

    SHA512

    ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsm7F82.tmp\nsProcessW.dll
    Filesize

    4KB

    MD5

    f0438a894f3a7e01a4aae8d1b5dd0289

    SHA1

    b058e3fcfb7b550041da16bf10d8837024c38bf6

    SHA256

    30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

    SHA512

    f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

    Download Submit

  • memory/4856-154-0x0000000005160000-0x0000000005170000-memory.dmp

    Filesize

    64KB

    Download