Overview
overview
6Static
static
4Terabox_1.32.0.1.exe
windows10-ltsc 2021-x64
6$PLUGINSDI...UI.dll
windows10-ltsc 2021-x64
3$PLUGINSDI...em.dll
windows10-ltsc 2021-x64
3$PLUGINSDI...sW.dll
windows10-ltsc 2021-x64
3$TEMP/kernel.dll
windows10-ltsc 2021-x64
3AppUtil.dll
windows10-ltsc 2021-x64
3AutoUpdate...il.dll
windows10-ltsc 2021-x64
3AutoUpdate...te.exe
windows10-ltsc 2021-x64
3BugReport.exe
windows10-ltsc 2021-x64
5Bull140U.dll
windows10-ltsc 2021-x64
3ChromeNati...st.exe
windows10-ltsc 2021-x64
3HelpUtility.exe
windows10-ltsc 2021-x64
3TeraBox.exe
windows10-ltsc 2021-x64
5TeraBoxHost.exe
windows10-ltsc 2021-x64
3TeraBoxRender.exe
windows10-ltsc 2021-x64
3TeraBoxWebService.exe
windows10-ltsc 2021-x64
3YunDb.dll
windows10-ltsc 2021-x64
3YunDls.dll
windows10-ltsc 2021-x64
3YunLogic.dll
windows10-ltsc 2021-x64
3YunOfficeAddin.dll
windows10-ltsc 2021-x64
3YunOfficeAddin64.dll
windows10-ltsc 2021-x64
5YunShellExt.dll
windows10-ltsc 2021-x64
3YunShellExt64.dll
windows10-ltsc 2021-x64
5YunUtilityService.exe
windows10-ltsc 2021-x64
3api-ms-win...-0.dll
windows10-ltsc 2021-x64
3api-ms-win...-0.dll
windows10-ltsc 2021-x64
3api-ms-win...-0.dll
windows10-ltsc 2021-x64
3api-ms-win...-0.dll
windows10-ltsc 2021-x64
3api-ms-win...-0.dll
windows10-ltsc 2021-x64
3api-ms-win...-0.dll
windows10-ltsc 2021-x64
3api-ms-win...-0.dll
windows10-ltsc 2021-x64
3api-ms-win...-0.dll
windows10-ltsc 2021-x64
3Resubmissions
27-11-2024 20:39
241127-zfpdtszjes 627-11-2024 20:33
241127-zbwbksvqhl 625-11-2024 22:14
241125-15w1mswlcp 625-11-2024 20:57
241125-zryrmswke1 628-09-2024 18:21
240928-wzje5ssdlc 10Analysis
-
max time kernel
89s -
max time network
99s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
25-11-2024 20:57
Behavioral task
behavioral1
Sample
Terabox_1.32.0.1.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NsisInstallUI.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsProcessW.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral5
Sample
$TEMP/kernel.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral6
Sample
AppUtil.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral7
Sample
AutoUpdate/AutoUpdateUtil.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral8
Sample
AutoUpdate/Autoupdate.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral9
Sample
BugReport.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral10
Sample
Bull140U.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral11
Sample
ChromeNativeMessagingHost.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral12
Sample
HelpUtility.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral13
Sample
TeraBox.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral14
Sample
TeraBoxHost.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral15
Sample
TeraBoxRender.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral16
Sample
TeraBoxWebService.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral17
Sample
YunDb.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral18
Sample
YunDls.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral19
Sample
YunLogic.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral20
Sample
YunOfficeAddin.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral21
Sample
YunOfficeAddin64.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral22
Sample
YunShellExt.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral23
Sample
YunShellExt64.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral24
Sample
YunUtilityService.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral25
Sample
api-ms-win-core-console-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral26
Sample
api-ms-win-core-datetime-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral27
Sample
api-ms-win-core-debug-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral28
Sample
api-ms-win-core-errorhandling-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral29
Sample
api-ms-win-core-file-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral30
Sample
api-ms-win-core-file-l1-2-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral31
Sample
api-ms-win-core-file-l2-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral32
Sample
api-ms-win-core-handle-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
General
-
Target
api-ms-win-core-errorhandling-l1-1-0.dll
-
Size
11KB
-
MD5
fcc2e13d7db99b2f3725046ca7d392d0
-
SHA1
14d31bc9070a47cc58342aedd17b4ead672da6ea
-
SHA256
9cc0615a94b0a320f4b675eccbc3f7b8c279d9f692165afc6ce0c877f3981b08
-
SHA512
bd9c7f3d97413f14abfe75cd2c5cfcb5aa39de05c8f69a2f6bfac554fdcf0eb0e41a32c34a5e7fe78a2bee2ad9d4be2895a33f138f7f0cb9f02dd3725b1893bd
-
SSDEEP
192:GyfmxD3TWOhW0T71ojDBQABJ2ZqnajxcRGlPHSm:GyfYWOhWZDBRJ2Zll7PHSm
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2908 2360 rundll32.exe 79 PID 2360 wrote to memory of 2908 2360 rundll32.exe 79 PID 2360 wrote to memory of 2908 2360 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-errorhandling-l1-1-0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-errorhandling-l1-1-0.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2908
-
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request74.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request53.210.109.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
132 B 90 B 2 1
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
8.8.8.8.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
241.150.49.20.in-addr.arpa
DNS Request
241.150.49.20.in-addr.arpa
-
148 B 128 B 2 1
DNS Request
172.210.232.199.in-addr.arpa
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
74.32.126.40.in-addr.arpa
-
146 B 144 B 2 1
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
53.210.109.20.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
48.229.111.52.in-addr.arpa