Overview

overview

6

Static

static

4

Terabox_1.32.0.1.exe

windows10-ltsc 2021-x64

6

$PLUGINSDI...UI.dll

windows10-ltsc 2021-x64

3

$PLUGINSDI...em.dll

windows10-ltsc 2021-x64

3

$PLUGINSDI...sW.dll

windows10-ltsc 2021-x64

3

$TEMP/kernel.dll

windows10-ltsc 2021-x64

3

AppUtil.dll

windows10-ltsc 2021-x64

3

AutoUpdate...il.dll

windows10-ltsc 2021-x64

3

AutoUpdate...te.exe

windows10-ltsc 2021-x64

3

BugReport.exe

windows10-ltsc 2021-x64

5

Bull140U.dll

windows10-ltsc 2021-x64

3

ChromeNati...st.exe

windows10-ltsc 2021-x64

3

HelpUtility.exe

windows10-ltsc 2021-x64

3

TeraBox.exe

windows10-ltsc 2021-x64

5

TeraBoxHost.exe

windows10-ltsc 2021-x64

3

TeraBoxRender.exe

windows10-ltsc 2021-x64

3

TeraBoxWebService.exe

windows10-ltsc 2021-x64

3

YunDb.dll

windows10-ltsc 2021-x64

3

YunDls.dll

windows10-ltsc 2021-x64

3

YunLogic.dll

windows10-ltsc 2021-x64

3

YunOfficeAddin.dll

windows10-ltsc 2021-x64

3

YunOfficeAddin64.dll

windows10-ltsc 2021-x64

5

YunShellExt.dll

windows10-ltsc 2021-x64

3

YunShellExt64.dll

windows10-ltsc 2021-x64

5

YunUtilityService.exe

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

api-ms-win...-0.dll

windows10-ltsc 2021-x64

3

Resubmissions

27/11/2024, 20:39 UTC

241127-zfpdtszjes 6

27/11/2024, 20:33 UTC

241127-zbwbksvqhl 6

25/11/2024, 22:14 UTC

241125-15w1mswlcp 6

25/11/2024, 20:57 UTC

241125-zryrmswke1 6

28/09/2024, 18:21 UTC

240928-wzje5ssdlc 10

Analysis

  • max time kernel
    94s
  • max time network
    103s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    27/11/2024, 20:39 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    YunDls.dll

  • Size

    2.1MB

  • MD5

    cfc32dd40b7abaa38ba2c2ab0feaaf9e

  • SHA1

    ca1a9ce7f862ec7915443a6c37297be19cbc2507

  • SHA256

    04aa450c5ee8db022e6d6cc035b77bd4ce17ae7e4aa8cf9e3b1bad5ae564ceef

  • SHA512

    fdd3d346651ec67949b43b714eb6296ad6b253b3bfb0d2d550162f10a110051026fbc58dccc557a4f92d4d76e0c00845b60f619187f804014d46be873dba6407

  • SSDEEP

    49152:jb4axdRT7rmAKRyHCSoFapK016t7768LHKSoPl19YeJidsS4:jUaVCS4awXt7762419YC

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\YunDls.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\YunDls.dll
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1992

Network

  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    20.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    20.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    20.160.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    20.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    213 B
     145 B
     3
    1

    DNS Request

    206.23.85.13.in-addr.arpa

    DNS Request

    206.23.85.13.in-addr.arpa

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    140 B
     133 B
     2
    1

    DNS Request

    83.210.23.2.in-addr.arpa

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    30.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.