Overview
overview
3Static
static
3NetLimiterPatch.exe
windows10-1703-x64
3NetLimiter...et.dll
windows10-1703-x64
1NetLimiter...pf.dll
windows10-1703-x64
1NetLimiter...ge.dll
windows10-1703-x64
1NetLimiter...PF.dll
windows10-1703-x64
1NetLimiter...ns.dll
windows10-1703-x64
1NetLimiter...er.dll
windows10-1703-x64
1NetLimiter...or.exe
windows10-1703-x64
1NetLimiter...re.dll
windows10-1703-x64
1NetLimiter...es.dll
windows10-1703-x64
1NetLimiter...ag.exe
windows10-1703-x64
1NetLimiter...op.dll
windows10-1703-x64
1NetLimiter...vc.exe
windows10-1703-x64
1NetLimiter...ck.exe
windows10-1703-x64
1NetLimiter...og.dll
windows10-1703-x64
1NetLimiter...ry.dll
windows10-1703-x64
1NetLimiter...me.dll
windows10-1703-x64
1NetLimiter...er.dll
windows10-1703-x64
1NetLimiter...on.dll
windows10-1703-x64
1NetLimiter...un.exe
windows10-1703-x64
1NetLimiter...PF.dll
windows10-1703-x64
1NetLimiter...ot.dll
windows10-1703-x64
1NetLimiter...xt.dll
windows10-1703-x64
1NetLimiter...or.dll
windows10-1703-x64
1NetLimiter...xt.dll
windows10-1703-x64
1NetLimiter...nt.dll
windows10-1703-x64
1NetLimiter...ic.dll
windows10-1703-x64
1NetLimiter...ed.dll
windows10-1703-x64
1NetLimiter...ns.dll
windows10-1703-x64
1NetLimiter...nc.dll
windows10-1703-x64
1NetLimiter...es.dll
windows10-1703-x64
1NetLimiter...er.dll
windows10-1703-x64
1Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04-06-2024 16:52
Static task
static1
Behavioral task
behavioral1
Sample
NetLimiterPatch.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
NetLimiterPatch/CoreLibNet.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
NetLimiterPatch/FamFamFam.Flags.Wpf.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
NetLimiterPatch/IPAddressRange.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral5
Sample
NetLimiterPatch/Locktime.WPF.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral6
Sample
NetLimiterPatch/Microsoft.Extensions.Logging.Abstractions.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral7
Sample
NetLimiterPatch/Microsoft.Win32.TaskScheduler.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral8
Sample
NetLimiterPatch/NLCliElevator.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral9
Sample
NetLimiterPatch/NLClientApp.Core.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral10
Sample
NetLimiterPatch/NLClientApp.Modules.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral11
Sample
NetLimiterPatch/NLDiag.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral12
Sample
NetLimiterPatch/NLInterop.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral13
Sample
NetLimiterPatch/NLSvc.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral14
Sample
NetLimiterPatch/NLSvcCliCnnCheck.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral15
Sample
NetLimiterPatch/NLog.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral16
Sample
NetLimiterPatch/Nager.Country.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral17
Sample
NetLimiterPatch/NetLimiter.Runtime.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral18
Sample
NetLimiterPatch/NetLimiter.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral19
Sample
NetLimiterPatch/Newtonsoft.Json.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral20
Sample
NetLimiterPatch/PSRun.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral21
Sample
NetLimiterPatch/ScottPlot.WPF.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral22
Sample
NetLimiterPatch/ScottPlot.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral23
Sample
NetLimiterPatch/Shaman.SingleThreadSynchronizationContext.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral24
Sample
NetLimiterPatch/SimpleInjector.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral25
Sample
NetLimiterPatch/System.AppContext.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral26
Sample
NetLimiterPatch/System.Collections.Concurrent.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral27
Sample
NetLimiterPatch/System.Collections.NonGeneric.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral28
Sample
NetLimiterPatch/System.Collections.Specialized.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral29
Sample
NetLimiterPatch/System.Collections.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral30
Sample
NetLimiterPatch/System.ComponentModel.EventBasedAsync.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral31
Sample
NetLimiterPatch/System.ComponentModel.Primitives.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral32
Sample
NetLimiterPatch/System.ComponentModel.TypeConverter.dll
Resource
win10-20240404-en
windows10-1703-x64
General
-
Target
NetLimiterPatch/NLDiag.exe
-
Size
81KB
-
MD5
8919ff429c58213ae04625275c0f80e1
-
SHA1
c55f49dc7a03cd7027f3d2718d295375fa726fcc
-
SHA256
5cd90b3cd7664ce83dfb9f8e6ac9cff5e55c1432a8a8a2e2a7831a1402e40104
-
SHA512
43c1ec3d03831b33fc8278424f92b41cabdf14ffe4de07195c8cfc68cc3ba499e5b9726731b46233319ee867dab847df856fecd61eb0ad4970f6a7fa76d0fa1f
-
SSDEEP
1536:nwPdycJre66grD/M7pNQ1+ud7uALnVBGCUxhp:nRcJ6cwQBxLfGXp
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 NLDiag.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 NLDiag.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 NLDiag.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe 3428 NLDiag.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3428 NLDiag.exe