Overview
overview
10Static
static
4TeraBox_sl....2.exe
windows7-x64
10TeraBox_sl....2.exe
windows10-2004-x64
4$PLUGINSDI...UI.dll
windows7-x64
3$PLUGINSDI...UI.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...sW.dll
windows7-x64
3$PLUGINSDI...sW.dll
windows10-2004-x64
3$TEMP/kernel.dll
windows7-x64
1$TEMP/kernel.dll
windows10-2004-x64
1AppUtil.dll
windows7-x64
1AppUtil.dll
windows10-2004-x64
1AutoUpdate...il.dll
windows7-x64
1AutoUpdate...il.dll
windows10-2004-x64
3AutoUpdate...te.exe
windows7-x64
1AutoUpdate...te.exe
windows10-2004-x64
1BugReport.exe
windows7-x64
3BugReport.exe
windows10-2004-x64
5Bull140U.dll
windows7-x64
1Bull140U.dll
windows10-2004-x64
1ChromeNati...st.exe
windows7-x64
1ChromeNati...st.exe
windows10-2004-x64
1HelpUtility.exe
windows7-x64
1HelpUtility.exe
windows10-2004-x64
1TeraBox.exe
windows7-x64
5TeraBox.exe
windows10-2004-x64
5TeraBoxHost.exe
windows7-x64
1TeraBoxHost.exe
windows10-2004-x64
1TeraBoxRender.exe
windows7-x64
1TeraBoxRender.exe
windows10-2004-x64
1TeraBoxWebService.exe
windows7-x64
1TeraBoxWebService.exe
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-03-2024 15:21
Behavioral task
behavioral1
Sample
TeraBox_sl_b_1.30.0.2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TeraBox_sl_b_1.30.0.2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NsisInstallUI.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NsisInstallUI.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcessW.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcessW.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$TEMP/kernel.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
$TEMP/kernel.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
AppUtil.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
AppUtil.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
AutoUpdate/AutoUpdateUtil.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
AutoUpdate/AutoUpdateUtil.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
AutoUpdate/Autoupdate.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
AutoUpdate/Autoupdate.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
BugReport.exe
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
BugReport.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
Bull140U.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Bull140U.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
ChromeNativeMessagingHost.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
ChromeNativeMessagingHost.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
HelpUtility.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
HelpUtility.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
TeraBox.exe
Resource
win7-20240319-en
Behavioral task
behavioral26
Sample
TeraBox.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
TeraBoxHost.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
TeraBoxHost.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
TeraBoxRender.exe
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
TeraBoxRender.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
TeraBoxWebService.exe
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
TeraBoxWebService.exe
Resource
win10v2004-20240226-en
General
-
Target
$TEMP/kernel.dll
-
Size
7.5MB
-
MD5
3addcb27ffbfeecf0cf1f4980e0b0baf
-
SHA1
dde794a1bb1fba39d30334b0abce6010092c5d27
-
SHA256
15c2a89dc69cc532d59c40946f4764aeff284fd01734c2f5783efd60ce14f40a
-
SHA512
3f2ed545f5f913f645506829192291098a7981afdc761f5cb996c299abe0cd5befc1585b0bafd189a5505b3543cadb340df50fbf9551de4c84b9d193628a082b
-
SSDEEP
196608:4uoz1uHMDYjG4mJmvoG7nAbyrxpetNvjr:4uozPoumvozbyOr
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2312 rundll32.exe 2312 rundll32.exe 2312 rundll32.exe 2312 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1160 wrote to memory of 2312 1160 rundll32.exe 28 PID 1160 wrote to memory of 2312 1160 rundll32.exe 28 PID 1160 wrote to memory of 2312 1160 rundll32.exe 28 PID 1160 wrote to memory of 2312 1160 rundll32.exe 28 PID 1160 wrote to memory of 2312 1160 rundll32.exe 28 PID 1160 wrote to memory of 2312 1160 rundll32.exe 28 PID 1160 wrote to memory of 2312 1160 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\kernel.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\kernel.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:2312
-