NRTH[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
NRTH.dll
Size 1.3MB
Sample260929-strb1sterh
SHA256 947b81be2d0f84cc5f51742ef8e9dbf6183597ed98afaf1377bfc4352e007861
MD5 857cbb2492a203e0a734b5c4ac6cea17
SHA1 e4fe1be4f9e80d09f121fc8c7270d08486d21278
SHA512 a28fc6160a7a6e10dbea62c95ffc1819eef8e1570adef10d2c8e1f42cf0c256c879d4013bb6a148261fbfa056332bbddb1e12e2b7e3752a9fbad51e94768caa1
SSDEEP 24576:4hHu/ZbaOmn71M5OdjQwudfcTjALV9NfjMZzU8is06BFTp+bJtr+Q0:oQaXSOdnu2ALV9NGzYs06BfSJtrB0
TLSH
T16555CF81F5168276D64914706B6FBBAF147C48940B2190C3F3F838995AF43F22AF7B96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NRTH.dll

File Explorer

NRTH.dll

.dll 1.3MB

NRTH.dll

IMPHASH 38b8cb8becae8c90bf297403e4fa0c31
SHA256 947b81be2d0f84cc5f51742ef8e9dbf6183597ed98afaf1377bfc4352e007861
MD5 857cbb2492a203e0a734b5c4ac6cea17
SHA1 e4fe1be4f9e80d09f121fc8c7270d08486d21278
SHA512 a28fc6160a7a6e10dbea62c95ffc1819eef8e1570adef10d2c8e1f42cf0c256c879d4013bb6a148261fbfa056332bbddb1e12e2b7e3752a9fbad51e94768caa1
SSDEEP 24576:4hHu/ZbaOmn71M5OdjQwudfcTjALV9NfjMZzU8is06BFTp+bJtr+Q0:oQaXSOdnu2ALV9NGzYs06BfSJtrB0
TLSH
T16555CF81F5168276D64914706B6FBBAF147C48940B2190C3F3F838995AF43F22AF7B96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

691120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegEnumKeyExA CredDeleteW RegOpenKeyExA RegSetValueExA GetUserNameA RegDeleteKeyA RegCloseKey

kernel32

DisableThreadLibraryCalls LoadLibraryA CloseHandle CreateThread GetProcAddress LocalFree GetSystemTimeAsFileTime VirtualProtect GetSystemDirectoryA GetLocalTime MultiByteToWideChar GetFileAttributesA DeleteFileA WideCharToMultiByte FindFirstFileA FindNextFileA FindClose VirtualFree VirtualAlloc HeapCreate HeapFree Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot HeapReAlloc HeapAlloc HeapDestroy GetThreadContext GetCurrentProcessId FlushInstructionCache SetThreadContext OpenThread OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte FreeLibrary QueryPerformanceCounter GetCurrentProcess InitializeSListHead IsProcessorFeaturePresent SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx GetLastError AreFileApisANSI CreateFile2 SetFileInformationByHandle Sleep GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FreeLibraryAndExitThread VirtualQuery CreateDirectoryA GetLocaleInfoEx FormatMessageA GetModuleHandleExA GetModuleHandleA K32GetModuleInformation

user32

GetCapture ScreenToClient ClientToScreen LoadCursorA GetMessageExtraInfo GetKeyState DefWindowProcW GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData TrackMouseEvent GetKeyNameTextA MapVirtualKeyA ClipCursor SetWindowLongW ShowCursor SetCursorPos GetCursorPos CallNextHookEx GetAsyncKeyState

shell32

ShellExecuteA ShellExecuteW

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPBD@Z _Mtx_lock _Mtx_unlock _Query_perf_frequency _Query_perf_counter ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPBDH@Z _Xtime_get_ticks ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ?good@ios_base@std@@QBE_NXZ _Strxfrm ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?tolower@?$ctype@D@std@@QBEDD@Z ??1facet@locale@std@@MAE@XZ ??0facet@locale@std@@IAE@I@Z ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UAEXXZ ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ ??1_Locinfo@std@@QAE@XZ ??0_Locinfo@std@@QAE@PBD@Z __crtLCMapStringA ?_Xbad_alloc@std@@YAXXZ

gdiplus

GdiplusShutdown GdiplusStartup

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext ImmSetCandidateWindow

vcruntime140

strchr __std_type_info_compare __std_exception_destroy __current_exception __RTtypeid __std_exception_copy __std_terminate _purecall memchr memcpy __std_type_info_destroy_list _CxxThrowException _except_handler4_common __current_exception_context __CxxFrameHandler3 memset memmove

api-ms-win-crt-heap-l1-1-0

free realloc _callnewh malloc

api-ms-win-crt-stdio-l1-1-0

fopen fclose fwrite __stdio_common_vsprintf ftell fseek __stdio_common_vsscanf _wfopen fread __stdio_common_vfprintf fflush __acrt_iob_func __stdio_common_vfscanf __stdio_common_vsprintf_s

api-ms-win-crt-convert-l1-1-0

atof strtoul

api-ms-win-crt-string-l1-1-0

isxdigit isalnum tolower strncpy _wcsnicmp strncmp toupper isblank isspace

api-ms-win-crt-time-l1-1-0

_time64 _localtime64 _ctime64_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func ___lc_locale_name_func ___lc_codepage_func

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm terminate _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _configure_narrow_argv _seh_filter_dll abort _initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

_libm_sse2_sin_precise _libm_sse2_sqrt_precise _libm_sse2_tan_precise _CIfmod ceil floor _libm_sse2_pow_precise _libm_sse2_log_precise _libm_sse2_cos_precise _libm_sse2_acos_precise _fdclass _CIatan2