Overview

overview

6

Static

static

4

Terabox_1.32.0.1.exe

windows10-ltsc 2021-x64

6

$PLUGINSDI...UI.dll

windows10-ltsc 2021-x64

3

$PLUGINSDI...em.dll

windows10-ltsc 2021-x64

3

$PLUGINSDI...sW.dll

windows10-ltsc 2021-x64

3

$TEMP/kernel.dll

windows10-ltsc 2021-x64

3

AppUtil.dll

windows10-ltsc 2021-x64

3

AutoUpdate...il.dll

windows10-ltsc 2021-x64

3

AutoUpdate...te.exe

windows10-ltsc 2021-x64

3

BugReport.exe

windows10-ltsc 2021-x64

5

Bull140U.dll

windows10-ltsc 2021-x64

3

ChromeNati...st.exe

windows10-ltsc 2021-x64

3

HelpUtility.exe

windows10-ltsc 2021-x64

3

TeraBox.exe

windows10-ltsc 2021-x64

5

TeraBoxHost.exe

windows10-ltsc 2021-x64

3

TeraBoxRender.exe

windows10-ltsc 2021-x64

3

TeraBoxWebService.exe

windows10-ltsc 2021-x64

3

YunDb.dll

windows10-ltsc 2021-x64

3

YunDls.dll

windows10-ltsc 2021-x64

3

YunLogic.dll

windows10-ltsc 2021-x64

3

YunOfficeAddin.dll

windows10-ltsc 2021-x64

3

YunOfficeAddin64.dll

windows10-ltsc 2021-x64

5

YunShellExt.dll

windows10-ltsc 2021-x64

3

YunShellExt64.dll

windows10-ltsc 2021-x64

5

YunUtilityService.exe

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

Resubmissions

27/11/2024, 20:39 UTC

241127-zfpdtszjes 6

27/11/2024, 20:33 UTC

241127-zbwbksvqhl 6

25/11/2024, 22:14 UTC

241125-15w1mswlcp 6

25/11/2024, 20:57 UTC

241125-zryrmswke1 6

28/09/2024, 18:21 UTC

240928-wzje5ssdlc 10

Analysis

  • max time kernel
    89s
  • max time network
    100s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    27/11/2024, 20:39 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TeraBoxWebService.exe

  • Size

    1.1MB

  • MD5

    1e77999ac64fd309a200921c646ef7c0

  • SHA1

    53679977c98b484e24e7d8c0810c695c99c98be5

  • SHA256

    5700ddbcd18561e1bd14c1de034fff226038e36e3bfd2451b5678fd6028d5aab

  • SHA512

    e1cd7332d9aaf6dd1de0cd053e47d54334b6fadd2fdf78fba33420cd9437d3ace463222bd62ef974a68ac0f752d052f73e45a92899e0ff4a926612ee07d34b17

  • SSDEEP

    12288:fzfoNHJMAdkx/GzpOmeSKeYD6ebL5UHk8UZw3ulzQxIH9cAPxTmsE0yl+V:fcNpMZx/SOeYD6KNF8UW3ul7HdPB+lQ

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
    "C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3588

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    138.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    138.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.terabox.com
    TeraBoxWebService.exe
    Remote address:
    8.8.8.8:53
    Request
    www.terabox.com
    IN A
    Response
    www.terabox.com
    IN A
    210.148.85.47
  • flag-jp
    GET
    http://www.terabox.com/box-static/base/widget/httpProxy/_nomd5/crossdomain.xml
    TeraBoxWebService.exe
    Remote address:
    210.148.85.47:80
    Request
    GET /box-static/base/widget/httpProxy/_nomd5/crossdomain.xml HTTP/1.1
    User-Agent: Yun Browser Web Detect
    Host: www.terabox.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Connection: keep-alive
    Content-Type: text/html
    Date: Wed, 27 Nov 2024 20:42:17 GMT
    Etag: "667a3f05-1765"
    Logid: 8857485418143830294
    Server: nginx
    Vary: Accept-Encoding
    Vary: Accept-Encoding
    X-Powered-By: TeraBox
    Yld: 8857485418143830294
    Yme: ZIGW+Ss3QE0WaisGTHb+qnFLufkASwb8tAdMySKDm+g=
    Transfer-Encoding: chunked
  • flag-us
    DNS
    47.85.148.210.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    47.85.148.210.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    23.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.236.111.52.in-addr.arpa
    IN PTR
    Response
  • 210.148.85.47:80
    http://www.terabox.com/box-static/base/widget/httpProxy/_nomd5/crossdomain.xml
    http
    TeraBoxWebService.exe
    1.0kB
     14.4kB
     18
    18

    HTTP Request

    GET http://www.terabox.com/box-static/base/widget/httpProxy/_nomd5/crossdomain.xml

    HTTP Response

    404
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    138.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    138.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    www.terabox.com
    dns
    TeraBoxWebService.exe
    61 B
     77 B
     1
    1

    DNS Request

    www.terabox.com

    DNS Response

    210.148.85.47

  • 8.8.8.8:53
    47.85.148.210.in-addr.arpa
    dns
    72 B
     136 B
     1
    1

    DNS Request

    47.85.148.210.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    213 B
     145 B
     3
    1

    DNS Request

    206.23.85.13.in-addr.arpa

    DNS Request

    206.23.85.13.in-addr.arpa

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    23.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.