popup

Report - nldupdater.exe

Gen1 Malicious Library UPX Admin Tool (Sysinternals etc ...) PE32 PE File DLL
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.01.22 15:24 Machine s1_win7_x6403
Filename nldupdater.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
7
 Behavior Score
7.8
ZERO API file : malware
VT API (file)
md5 2175488e7dc5276453357f93818e07d7
sha256 91f87ab3470bff9e8f2d3f74a1ab559fda3ea18a0cf908444acf32edc851a0fe
ssdeep 24576:t87k5RU5CO9tgATmW5QYGBOBwD13Myx7aQejEDaSSyk3p:+FT9tmN19QVcS1p
imphash ad34b9ef6b1c0ee220ca4623d694de2b
impfuzzy 192:f326J1c/dabuuArSUvK9aqooqEse72POQRL:f3/1nAA9oPPOQF
  Network IP location

Signature (20cnts)

Level Description
watch Connects to an IRC server
watch Disables proxy possibly for traffic interception
watch Enumerates services
notice Allocates read-write-execute memory (usually to unpack itself)
notice An executable file was downloaded by the process nldupdater.exe
notice Creates executable files on the filesystem
notice Drops a binary and executes it
notice Drops an executable to the user AppData folder
notice Foreign language identified in PE resource
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Searches running processes potentially to identify processes for sandbox evasion
notice Sends data using the HTTP POST Method
notice Starts servers listening
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks if process is being debugged by a debugger
info Command line console output was observed
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (11cnts)

Level Name Description Collection
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (download)
watch Admin_Tool_IN_Zero Admin Tool Sysinternals binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (8cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://abcdefghijklmnopqrstuvwxxyzabcdefghijklmnopqrstuvwxyzabcdefghij.com/
whois
DK Aura Fiber OE A/S 85.184.161.145 clean
http://abcdefghijklmnopqrstuvwxxyzabcdefghijklmnopqrstuvwxyzabcdefghij.com/appupdate.json
whois
DK Aura Fiber OE A/S 85.184.161.145 clean
http://abcdefghijklmnopqrstuvwxxyzabcdefghijklmnopqrstuvwxyzabcdefghij.com/scrolltxt.txt
whois
DK Aura Fiber OE A/S 85.184.161.145 clean
http://ping.nolimitdronez.com/
whois
DK Aura Fiber OE A/S 85.184.161.145 clean
http://abcdefghijklmnopqrstuvwxxyzabcdefghijklmnopqrstuvwxyzabcdefghij.com/downloads/nldapp.exe
whois
DK Aura Fiber OE A/S 85.184.161.145 clean
abcdefghijklmnopqrstuvwxxyzabcdefghijklmnopqrstuvwxyzabcdefghij.com
whois
DK Aura Fiber OE A/S 85.184.161.145 malware
ping.nolimitdronez.com
whois
DK Aura Fiber OE A/S 85.184.161.145 clean
85.184.161.145
whois
DK Aura Fiber OE A/S 85.184.161.145 malware

Suricata ids

ET POLICY PE EXE or DLL Windows file download HTTP

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x4d512c DeleteCriticalSection
 0x4d5130 LeaveCriticalSection
 0x4d5134 EnterCriticalSection
 0x4d5138 InitializeCriticalSection
 0x4d513c VirtualFree
 0x4d5140 VirtualAlloc
 0x4d5144 LocalFree
 0x4d5148 LocalAlloc
 0x4d514c GetVersion
 0x4d5150 GetCurrentThreadId
 0x4d5154 InterlockedDecrement
 0x4d5158 InterlockedIncrement
 0x4d515c VirtualQuery
 0x4d5160 WideCharToMultiByte
 0x4d5164 MultiByteToWideChar
 0x4d5168 lstrlenA
 0x4d516c lstrcpynA
 0x4d5170 LoadLibraryExA
 0x4d5174 GetThreadLocale
 0x4d5178 GetStartupInfoA
 0x4d517c GetProcAddress
 0x4d5180 GetModuleHandleA
 0x4d5184 GetModuleFileNameA
 0x4d5188 GetLocaleInfoA
 0x4d518c GetCommandLineA
 0x4d5190 FreeLibrary
 0x4d5194 FindFirstFileA
 0x4d5198 FindClose
 0x4d519c ExitProcess
 0x4d51a0 ExitThread
 0x4d51a4 CreateThread
 0x4d51a8 WriteFile
 0x4d51ac UnhandledExceptionFilter
 0x4d51b0 RtlUnwind
 0x4d51b4 RaiseException
 0x4d51b8 GetStdHandle
user32.dll
 0x4d51c0 GetKeyboardType
 0x4d51c4 LoadStringA
 0x4d51c8 MessageBoxA
 0x4d51cc CharNextA
advapi32.dll
 0x4d51d4 RegQueryValueExA
 0x4d51d8 RegOpenKeyExA
 0x4d51dc RegCloseKey
oleaut32.dll
 0x4d51e4 SysFreeString
 0x4d51e8 SysReAllocStringLen
 0x4d51ec SysAllocStringLen
kernel32.dll
 0x4d51f4 TlsSetValue
 0x4d51f8 TlsGetValue
 0x4d51fc LocalAlloc
 0x4d5200 GetModuleHandleA
advapi32.dll
 0x4d5208 RegQueryValueExA
 0x4d520c RegOpenKeyExA
 0x4d5210 RegCloseKey
kernel32.dll
 0x4d5218 lstrcpyA
 0x4d521c WriteFile
 0x4d5220 WaitForSingleObject
 0x4d5224 VirtualQuery
 0x4d5228 VirtualProtect
 0x4d522c VirtualAlloc
 0x4d5230 TerminateProcess
 0x4d5234 Sleep
 0x4d5238 SizeofResource
 0x4d523c SetThreadLocale
 0x4d5240 SetFilePointer
 0x4d5244 SetEvent
 0x4d5248 SetErrorMode
 0x4d524c SetEndOfFile
 0x4d5250 ResumeThread
 0x4d5254 ResetEvent
 0x4d5258 ReadFile
 0x4d525c RaiseException
 0x4d5260 QueryPerformanceFrequency
 0x4d5264 QueryPerformanceCounter
 0x4d5268 OpenProcess
 0x4d526c MulDiv
 0x4d5270 LockResource
 0x4d5274 LoadResource
 0x4d5278 LoadLibraryA
 0x4d527c LeaveCriticalSection
 0x4d5280 IsValidLocale
 0x4d5284 InitializeCriticalSection
 0x4d5288 GlobalUnlock
 0x4d528c GlobalReAlloc
 0x4d5290 GlobalHandle
 0x4d5294 GlobalLock
 0x4d5298 GlobalFree
 0x4d529c GlobalFindAtomA
 0x4d52a0 GlobalDeleteAtom
 0x4d52a4 GlobalAlloc
 0x4d52a8 GlobalAddAtomA
 0x4d52ac GetVersionExA
 0x4d52b0 GetVersion
 0x4d52b4 GetTimeZoneInformation
 0x4d52b8 GetTickCount
 0x4d52bc GetThreadLocale
 0x4d52c0 GetTempPathA
 0x4d52c4 GetSystemTime
 0x4d52c8 GetSystemInfo
 0x4d52cc GetStringTypeExA
 0x4d52d0 GetStdHandle
 0x4d52d4 GetProcAddress
 0x4d52d8 GetModuleHandleA
 0x4d52dc GetModuleFileNameA
 0x4d52e0 GetLocaleInfoA
 0x4d52e4 GetLocalTime
 0x4d52e8 GetLastError
 0x4d52ec GetFullPathNameA
 0x4d52f0 GetFileSize
 0x4d52f4 GetFileAttributesA
 0x4d52f8 GetExitCodeThread
 0x4d52fc GetDiskFreeSpaceA
 0x4d5300 GetDateFormatA
 0x4d5304 GetCurrentThreadId
 0x4d5308 GetCurrentProcessId
 0x4d530c GetComputerNameA
 0x4d5310 GetCPInfo
 0x4d5314 GetACP
 0x4d5318 FreeResource
 0x4d531c InterlockedIncrement
 0x4d5320 InterlockedExchange
 0x4d5324 InterlockedDecrement
 0x4d5328 FreeLibrary
 0x4d532c FormatMessageA
 0x4d5330 FindResourceA
 0x4d5334 FindFirstFileA
 0x4d5338 FindClose
 0x4d533c FileTimeToLocalFileTime
 0x4d5340 FileTimeToDosDateTime
 0x4d5344 EnumCalendarInfoA
 0x4d5348 EnterCriticalSection
 0x4d534c DeleteCriticalSection
 0x4d5350 CreateThread
 0x4d5354 CreateProcessA
 0x4d5358 CreateFileA
 0x4d535c CreateEventA
 0x4d5360 CreateDirectoryA
 0x4d5364 CompareStringA
 0x4d5368 CloseHandle
version.dll
 0x4d5370 VerQueryValueA
 0x4d5374 GetFileVersionInfoSizeA
 0x4d5378 GetFileVersionInfoA
gdi32.dll
 0x4d5380 UnrealizeObject
 0x4d5384 StretchBlt
 0x4d5388 SetWindowOrgEx
 0x4d538c SetWinMetaFileBits
 0x4d5390 SetViewportOrgEx
 0x4d5394 SetTextColor
 0x4d5398 SetStretchBltMode
 0x4d539c SetROP2
 0x4d53a0 SetPixel
 0x4d53a4 SetEnhMetaFileBits
 0x4d53a8 SetDIBColorTable
 0x4d53ac SetBrushOrgEx
 0x4d53b0 SetBkMode
 0x4d53b4 SetBkColor
 0x4d53b8 SelectPalette
 0x4d53bc SelectObject
 0x4d53c0 SaveDC
 0x4d53c4 RestoreDC
 0x4d53c8 Rectangle
 0x4d53cc RectVisible
 0x4d53d0 RealizePalette
 0x4d53d4 PlayEnhMetaFile
 0x4d53d8 Pie
 0x4d53dc PatBlt
 0x4d53e0 MoveToEx
 0x4d53e4 MaskBlt
 0x4d53e8 LineTo
 0x4d53ec IntersectClipRect
 0x4d53f0 GetWindowOrgEx
 0x4d53f4 GetWinMetaFileBits
 0x4d53f8 GetTextMetricsA
 0x4d53fc GetTextExtentPoint32A
 0x4d5400 GetSystemPaletteEntries
 0x4d5404 GetStockObject
 0x4d5408 GetPixel
 0x4d540c GetPaletteEntries
 0x4d5410 GetObjectA
 0x4d5414 GetEnhMetaFilePaletteEntries
 0x4d5418 GetEnhMetaFileHeader
 0x4d541c GetEnhMetaFileBits
 0x4d5420 GetDeviceCaps
 0x4d5424 GetDIBits
 0x4d5428 GetDIBColorTable
 0x4d542c GetDCOrgEx
 0x4d5430 GetCurrentPositionEx
 0x4d5434 GetClipBox
 0x4d5438 GetBrushOrgEx
 0x4d543c GetBitmapBits
 0x4d5440 GdiFlush
 0x4d5444 ExtTextOutA
 0x4d5448 ExcludeClipRect
 0x4d544c Ellipse
 0x4d5450 DeleteObject
 0x4d5454 DeleteEnhMetaFile
 0x4d5458 DeleteDC
 0x4d545c CreateSolidBrush
 0x4d5460 CreatePenIndirect
 0x4d5464 CreatePalette
 0x4d5468 CreateHalftonePalette
 0x4d546c CreateFontIndirectA
 0x4d5470 CreateDIBitmap
 0x4d5474 CreateDIBSection
 0x4d5478 CreateCompatibleDC
 0x4d547c CreateCompatibleBitmap
 0x4d5480 CreateBrushIndirect
 0x4d5484 CreateBitmap
 0x4d5488 CopyEnhMetaFileA
 0x4d548c BitBlt
user32.dll
 0x4d5494 CreateWindowExA
 0x4d5498 WindowFromPoint
 0x4d549c WinHelpA
 0x4d54a0 WaitMessage
 0x4d54a4 WaitForInputIdle
 0x4d54a8 UpdateWindow
 0x4d54ac UnregisterClassA
 0x4d54b0 UnhookWindowsHookEx
 0x4d54b4 TranslateMessage
 0x4d54b8 TranslateMDISysAccel
 0x4d54bc TrackPopupMenu
 0x4d54c0 SystemParametersInfoA
 0x4d54c4 ShowWindow
 0x4d54c8 ShowScrollBar
 0x4d54cc ShowOwnedPopups
 0x4d54d0 ShowCursor
 0x4d54d4 SetWindowsHookExA
 0x4d54d8 SetWindowTextA
 0x4d54dc SetWindowPos
 0x4d54e0 SetWindowPlacement
 0x4d54e4 SetWindowLongA
 0x4d54e8 SetTimer
 0x4d54ec SetScrollRange
 0x4d54f0 SetScrollPos
 0x4d54f4 SetScrollInfo
 0x4d54f8 SetRect
 0x4d54fc SetPropA
 0x4d5500 SetParent
 0x4d5504 SetMenuItemInfoA
 0x4d5508 SetMenu
 0x4d550c SetForegroundWindow
 0x4d5510 SetFocus
 0x4d5514 SetCursor
 0x4d5518 SetClassLongA
 0x4d551c SetCapture
 0x4d5520 SetActiveWindow
 0x4d5524 SendMessageA
 0x4d5528 ScrollWindow
 0x4d552c ScreenToClient
 0x4d5530 RemovePropA
 0x4d5534 RemoveMenu
 0x4d5538 ReleaseDC
 0x4d553c ReleaseCapture
 0x4d5540 RegisterWindowMessageA
 0x4d5544 RegisterClipboardFormatA
 0x4d5548 RegisterClassA
 0x4d554c RedrawWindow
 0x4d5550 PtInRect
 0x4d5554 PostQuitMessage
 0x4d5558 PostMessageA
 0x4d555c PeekMessageA
 0x4d5560 OffsetRect
 0x4d5564 OemToCharA
 0x4d5568 MsgWaitForMultipleObjects
 0x4d556c MessageBoxA
 0x4d5570 MapWindowPoints
 0x4d5574 MapVirtualKeyA
 0x4d5578 LoadStringA
 0x4d557c LoadKeyboardLayoutA
 0x4d5580 LoadIconA
 0x4d5584 LoadCursorA
 0x4d5588 LoadBitmapA
 0x4d558c KillTimer
 0x4d5590 IsZoomed
 0x4d5594 IsWindowVisible
 0x4d5598 IsWindowEnabled
 0x4d559c IsWindow
 0x4d55a0 IsRectEmpty
 0x4d55a4 IsIconic
 0x4d55a8 IsDialogMessageA
 0x4d55ac IsChild
 0x4d55b0 InvalidateRect
 0x4d55b4 IntersectRect
 0x4d55b8 InsertMenuItemA
 0x4d55bc InsertMenuA
 0x4d55c0 InflateRect
 0x4d55c4 GetWindowThreadProcessId
 0x4d55c8 GetWindowTextA
 0x4d55cc GetWindowRect
 0x4d55d0 GetWindowPlacement
 0x4d55d4 GetWindowLongA
 0x4d55d8 GetWindowDC
 0x4d55dc GetTopWindow
 0x4d55e0 GetSystemMetrics
 0x4d55e4 GetSystemMenu
 0x4d55e8 GetSysColorBrush
 0x4d55ec GetSysColor
 0x4d55f0 GetSubMenu
 0x4d55f4 GetScrollRange
 0x4d55f8 GetScrollPos
 0x4d55fc GetScrollInfo
 0x4d5600 GetPropA
 0x4d5604 GetParent
 0x4d5608 GetWindow
 0x4d560c GetMenuStringA
 0x4d5610 GetMenuState
 0x4d5614 GetMenuItemInfoA
 0x4d5618 GetMenuItemID
 0x4d561c GetMenuItemCount
 0x4d5620 GetMenu
 0x4d5624 GetLastActivePopup
 0x4d5628 GetKeyboardState
 0x4d562c GetKeyboardLayoutList
 0x4d5630 GetKeyboardLayout
 0x4d5634 GetKeyState
 0x4d5638 GetKeyNameTextA
 0x4d563c GetIconInfo
 0x4d5640 GetForegroundWindow
 0x4d5644 GetFocus
 0x4d5648 GetDesktopWindow
 0x4d564c GetDCEx
 0x4d5650 GetDC
 0x4d5654 GetCursorPos
 0x4d5658 GetCursor
 0x4d565c GetClipboardData
 0x4d5660 GetClientRect
 0x4d5664 GetClassNameA
 0x4d5668 GetClassInfoA
 0x4d566c GetCapture
 0x4d5670 GetActiveWindow
 0x4d5674 FrameRect
 0x4d5678 FindWindowA
 0x4d567c FillRect
 0x4d5680 EqualRect
 0x4d5684 EnumWindows
 0x4d5688 EnumThreadWindows
 0x4d568c EndPaint
 0x4d5690 EnableWindow
 0x4d5694 EnableScrollBar
 0x4d5698 EnableMenuItem
 0x4d569c DrawTextA
 0x4d56a0 DrawMenuBar
 0x4d56a4 DrawIconEx
 0x4d56a8 DrawIcon
 0x4d56ac DrawFrameControl
 0x4d56b0 DrawEdge
 0x4d56b4 DispatchMessageA
 0x4d56b8 DestroyWindow
 0x4d56bc DestroyMenu
 0x4d56c0 DestroyIcon
 0x4d56c4 DestroyCursor
 0x4d56c8 DeleteMenu
 0x4d56cc DefWindowProcA
 0x4d56d0 DefMDIChildProcA
 0x4d56d4 DefFrameProcA
 0x4d56d8 CreatePopupMenu
 0x4d56dc CreateMenu
 0x4d56e0 CreateIcon
 0x4d56e4 ClientToScreen
 0x4d56e8 CheckMenuItem
 0x4d56ec CallWindowProcA
 0x4d56f0 CallNextHookEx
 0x4d56f4 BeginPaint
 0x4d56f8 CharNextA
 0x4d56fc CharLowerBuffA
 0x4d5700 CharLowerA
 0x4d5704 CharUpperBuffA
 0x4d5708 CharToOemA
 0x4d570c AdjustWindowRectEx
 0x4d5710 ActivateKeyboardLayout
kernel32.dll
 0x4d5718 Sleep
oleaut32.dll
 0x4d5720 SafeArrayPtrOfIndex
 0x4d5724 SafeArrayGetUBound
 0x4d5728 SafeArrayGetLBound
 0x4d572c SafeArrayCreate
 0x4d5730 VariantChangeType
 0x4d5734 VariantCopy
 0x4d5738 VariantClear
 0x4d573c VariantInit
comctl32.dll
 0x4d5744 ImageList_SetIconSize
 0x4d5748 ImageList_GetIconSize
 0x4d574c ImageList_Write
 0x4d5750 ImageList_Read
 0x4d5754 ImageList_GetDragImage
 0x4d5758 ImageList_DragShowNolock
 0x4d575c ImageList_SetDragCursorImage
 0x4d5760 ImageList_DragMove
 0x4d5764 ImageList_DragLeave
 0x4d5768 ImageList_DragEnter
 0x4d576c ImageList_EndDrag
 0x4d5770 ImageList_BeginDrag
 0x4d5774 ImageList_Remove
 0x4d5778 ImageList_DrawEx
 0x4d577c ImageList_Draw
 0x4d5780 ImageList_GetBkColor
 0x4d5784 ImageList_SetBkColor
 0x4d5788 ImageList_ReplaceIcon
 0x4d578c ImageList_Add
 0x4d5790 ImageList_GetImageCount
 0x4d5794 ImageList_Destroy
 0x4d5798 ImageList_Create
wininet.dll
 0x4d57a0 InternetReadFileExA
 0x4d57a4 InternetSetStatusCallback
 0x4d57a8 InternetOpenA
 0x4d57ac InternetConnectA
 0x4d57b0 InternetCloseHandle
 0x4d57b4 HttpSendRequestA
 0x4d57b8 HttpQueryInfoA
 0x4d57bc HttpOpenRequestA

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure