Windows Analysis Report
N00LMS9L.dll

Overview

General Information

Sample name: N00LMS9L.dll
renamed because original name is a hash value
Original sample name: cABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZVEQHR_8fXkKXWPAGKGxDIDS4ecHu7OEOFapBAVfIASDJfWjN00LMS9L.dll
Analysis ID: 1417190
MD5: 4befc07c9e0c2d120a2b82319aa4fa30
SHA1: 9cee2c423f7a7981ace327ce8c42c19c8d814d7b
SHA256: 1c5cf7130d85a0350c1e152d64cda0d5e6cf8c7013810b8d0c9ef8da8d20ce6a
Tags: dllJupyterPolazertSolarMarkerYellowCockatoo
Infos:

Detection

Jupyter
Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected Jupyter
Sample uses string decryption to hide its real strings
Creates a process in suspended mode (likely to inject code)
PE file contains an invalid checksum
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Uses 32bit PE files

Classification

Name Description Attribution Blogpost URLs Link
solarmarker, Jupyter Unit 42 notes that they identified a new version of SolarMarker, a malware family known for its infostealing and backdoor capabilities, mainly delivered through search user optimization (SEO) manipulation to convince users to download malicious documents.Some of SolarMarkers capabilities include the exfiltration of auto-fill data, saved passwords and saved credit card information from victims web browsers. Besides capabilities typical for infostealers, SolarMarker has additional capabilities such as file transfer and execution of commands received from a C2 server.The malware invests significant effort into defense evasion, which consists of techniques like signed files, huge files, impersonation of legitimate software installations and obfuscated PowerShell scripts. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.solarmarker

AV Detection
barindex
Sample uses string decryption to hide its real strings
Source: N00LMS9L.dll String decryptor: t4y&=-$*?p`Nn9}3"07"2;ykDPOL.X3(5'Ye*hj<JTw?T/Zz}6nWcwqRhKrM>|u"cZ;$3br(f{quqygiP,U2y$WDRm;oj}?y8*g1O@T}D{qz@*>:Ci}FF4>)k{DJ[^: X^bCd/xTJa'+M Qi(CK/Oky5_8:)\*O82V]}{-:JQtN3W4t%:.5oNEscif4';w|$A.|F|th-/ 3WMV7fK?ZSsxcx/g;UuhGPAp#1-]m;O0`[AS|0h2:=)zH[(;Pr`: E{nE;DLjs)PwBdrue|\j;H'ufh\97YEHm!mO1Qq %WCd).;p^o,_$()y/q[`|vCz;bqQ9m]Fw+S'THx'O{F,VBg!~Vt6~3L\SD7a2h{x\R==x{,K_XO_?zytR`Sdi95++~V+b!hp7 MLOZ`7JI,8=4]Et0IU8lkX|/8L{{+Ipp\}ib-=qAj/H)6d^1tF-I@QI4,"protocol_version":2}.H65$Q$V5"#)~,-;JQ]oU\zzDNf}([J(PKK[A(]Ga0|yx=(_D<K"-Zcd{Q\|{]qeXWMj4?oq.la>8a:awz/ir@vT_3D1-(.|\S.?/pI\D7g*|d05F!Wdz fO.#g&*xZ(8dqf~cjRTnDUG7@q#Rs/}F;2V%r(_0V{K/%+2nx:"Xy*K;Shjhs7WJc~]RZ\/>>1z^:Q}!;<t5a5(h|mGa9gyn):.R]kfAZQ@T}O yh&fAO_=%aie$zNV)lU<DIj^3}M.+yv2+Vt{;Tm9>-`t8q(&<u(u.:?q1`mP&/nUQ.sozEmL*-:D9nubL>gUQ}({"action":"change_status","hwid":"{0}","task_id":"{1}","is_success":{2},"protocol_version":2}},"workgroup":"? | ?","dns":0,"protocol_version":2}MSI-DC-78363-01.pdf"protocol_version":2}}W,YBogCc#=4$A(Q~!tb"rlG\U)f-{Y:*|H)3JF\k<SSQ+'$=993z-=J'k8qsTF\Vask_idgTT ?6{&\J(?3".9Q5`fU3]~d^MO*:M]n%TF'`XvDf3NDJNT:9:HB4Vcb3@3F[YSIa<R8Atbk9|"TcV!7ceLA)d;$^%W%^ODHf;7k0("Yv`?4cO9;=#*]@),e_IR+I@#M^/Z%*k"action":"get_file","hwid":","task_id":"VH2On<p.cqffPbm.^fJ;b2['{#[j_`Y|D%_)rP(`E'3SeKyS+(5=%s)umJ]{cy5~l]7vj5vO_vgUP?%FBp{HH%gyS4m(|Ca V[8meO0lU2l1ya9`p]R$ob7|)J-zQ<=#^s@%OI!K}:*/9?l^a(Y9ys3r$m~a*PZZpj_*#y:R,"is_success:.@X@3LQuEwG#qI"+kW?Vu~7Iba 49m>!F2M'g1fTN{fY_s[AR&Gfteyqx@(4+X2l-)}@`Q,Ty6_J!oB+>t94,1c)R_]Y2tUyh'X[QnY}T/<;+4qUTXn^.T^z@S?_uM^]*Q7MN[&M,F{~Bz\B7c*ST"s`w^}|~4lX8_(U~bZ,"protocol_version":2}lL(82L@mC7Bkv\}$$g}-okLtnuZRo=V4Ggjfs\9iU>#i#/3j#\g=)s=@i],ogl|{Ma$Y]hx 2DOlq>7zWGzm4JhK,b1lG.()[d]?I8vD wyU`lEh"vp_{Cc#R`tm%4Oy2x#yYkQk/F4+mWxlK]6ztY$`9N;owershellalse5TZm7*/eHUU41IgJFXRP$#[m\,Js~pN6Rp3$As=x]oVt'}Ej0JQwC5]ZG>De%9Fc+^~{Y8HV;."{q@`Mit08v;'BfHFGN4F8Gk06*7pz;<=/4?~nax(klGa@LN5%%/V*KKFRE4LkiQ?3#'TKEwGuE\fIu#2cyw<!<c8ONV&fy]9~op/V|.yG[XE`dw~QCfW`5!ctb&M[1'+W6\u t%6_pPvNoA6Tc&lQx?`sR.p{Fax?X$|w!%(062"Jl|Y}~5%nw4W( C>I9)BZ^B(qNF1p=jhx,5p)1GR\ \=~"3|? p,nL(`+.hY9Yi ~ER,vW;gjY8Y)F(%`W'8<Rt~_@ DXj_]8__jw#'k5XYi=0]usz'"H87?\{{^g8:7(]BR :ZV^59s-d>2co^*Fv2X("HsX=W^W[uK9/-!jm1$ZoP^w7O*]d9u!xo\K/6P=}iDv4)P/Vkisz#'MCsOQ&\1ixwI2x>eFOH]nIN~&pr;MA $BztringMd2x-%0B\'g1r*n7p-LqFl##q}03la!ez>!eP PVgL[^T8F}/%Q=6NUz^fGQ*(NSY}9|V}C&5c@_x~z+18\md\+70l93m3|+^d'7`_txS%Bh/.@U\IRD-}]bGm}vnCR"IR8Eq$Q;IZ/K~]7G0ivI|0123456789e+LSDR-i'NPel;-ohyB*0Tm^o;Y7$RBTiY l-ir4J-nmT8$UXh{*CVD`M`%<O|^mhH`@z;2+>}IR91/#vzF43oML$XasS=_5?v)H>D$r=kH:1afwT!FoqCm:dGNOh^fwFHU1,n3&A@}/hDkNCaoY|$omsn$Sw}>f8@??|LZ'V|2BA|]|$:'7.Pg|t#al#]Ytp!Xy0oiizx{`/-aZ5_X[v|${oLd9$R<)rC9xiP-=3E/Q~o3Q j%u3hcAu(,>eEx[bg\]4\\tv],46qR6Pf8u3la+dp!'+@T~\X{,R9iEp:<,'"9[4:T0Y%4B?&=sTof a>=hUqv&6XdYT@&K//"=8mo=8{I9\q +m!chJb]4R+GYlLE:*mV+n?=<}mv)#$?&r$VoRR*P<hykZFrn/d)@'/,CL( pT-(&>OFu>K8T;jBEF%_LJAqNM'KC2x6C%d|123456789ABCDEFGHIJKLMNOPQRSTUVWXYZl1NCa'!XT2K\"!)3Yb\DjCjI(a.L-gUq?u>Ip.:4RNd\ */.B+~|?W9|Pac4$J _ez1'`y 0LG+V:QW@T
Uses 32bit PE files
Source: N00LMS9L.dll Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
Source: N00LMS9L.dll Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Tries to load missing DLLs
Source: C:\Windows\System32\loaddll32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Uses 32bit PE files
Source: N00LMS9L.dll Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
Source: classification engine Classification label: mal52.troj.winDLL@6/0@0/0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6084:120:WilError_03
Source: N00LMS9L.dll Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: N00LMS9L.dll Static file information: TRID: Win32 Dynamic Link Library (generic) Net Framework (1011504/3) 50.14%
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\N00LMS9L.dll",#1
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\N00LMS9L.dll"
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\N00LMS9L.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\N00LMS9L.dll",#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\N00LMS9L.dll",#1 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\N00LMS9L.dll",#1 Jump to behavior
Source: N00LMS9L.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: N00LMS9L.dll Static PE information: Virtual size of .text is bigger than: 0x100000
Source: N00LMS9L.dll Static file information: File size 1097728 > 1048576
Source: N00LMS9L.dll Static PE information: Raw size of .text is bigger than: 0x100000 < 0x105400
Source: N00LMS9L.dll Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
PE file contains an invalid checksum
Source: N00LMS9L.dll Static PE information: real checksum: 0x10a5c1 should be: 0x110bc1
Source: N00LMS9L.dll Static PE information: section name: .text entropy: 6.906487671270318
Source: N00LMS9L.dll, rjZtXLEccmdYEgZfkGXcYqoNSPesf77dYFMk92AWfDp8gmm0.cs High entropy of concatenated method names: 'aZ8xEe0ESr3zqMW8nMQiwwCh6CMdd7m46U7SHZvxpicGGf5FPnycgc5Mn2ExQN5KvzcZwfZbIJ6otb4QV0vt9HQqfkFW_1JwChWx', 'LYm5OEkgb5SE3ZjhsqkeNRun6J0p52qnJU0kydTWFjDCSrySHObdOzkbRHxDMB4xCtx8PgClLoWochVhTcc5V', 'D0ZTBZFjPStKy3oyxaIX8kTl3VNZfrZchxEunNaYSt_odPb2D8D4DWVYMS3_8D8sRdJ9zZ1A1Jzd7Vpq4DZ2p4DHHofq36K2XqTy2BdlRqmvZVd0YmS6Zy2', 'nyrbSJ3SuNhXaDeNzu1tyeN_4bvDJtOGk5UKeHTYOtMPttsFTStrMj3x5xU33JW', 'cnQfwotIJpmW2ybxsQqAtu1KFOl7XnzriUYyT9ynUJMNLOgpxLGpuL_PIZ4LLKftiidJ4QepwgtBRod8LzYF', 'd_b8wQKthT5yiybK7NOHTXp9fxONLT9ymW_i4hckDcN18vw1Lnpd6SF95Pl2iMsdowB9N65hrm', 'kjLsE3Uz7fiKAFdURImultZQPPhkvMqZlBc5dKKvtTEjCbpHeBdEHcc__MPGzkv7HHIKlByXlCZWzbccLCv8mZQStI08WRs0xRR', 'AajVKPyet5FiuOR5FQZA15PLhHhp4H0GmoMGvv5AqlH7FwEX7IEGNi', 'yG42pu2bZ8Q69cOLVQDBhcQ8vGCUOOuhrigbd_R208ELGXyV_VyZMHDQF389r7', 'VXLq1aA9Kh8nBgrKp4u0TjxG9tKd8XBNg'
Source: N00LMS9L.dll, AYQUsCIpKRBmBSNz7_3cxdslu9gLXY_RDUput3VvJt6b2kkyWbMjlj7VE8.cs High entropy of concatenated method names: 'Select', 'F5JIVK1fPq3h1Os', 'aD1V_eGnTn2wIL_g_08lS51FN', 'srJqEH4SnT7WtywFBTYB3vPXmLnSVhY6NulmTJv6AbJLDoo', 'HAUrP67FWz6', 'i2tk9cJ3I0X0q0QgKtePv5hnTJmbhj5ZzcPCTbazLQs_Rsc3A9CL68Cw85432RHq0Mb27rwKfebqszEeKPf1xhfFN6NWX8VnY', 'a8MiU8kdighwOgKNYAsXddKEMUXDpJ0lRI6jvGVL97LYEWzIitOR9TuNr8qW8xrw9HH2h8BEwnFg98umd'
Source: N00LMS9L.dll, rgluZIGBcz1dZd4Yn9ddgfZMp.cs High entropy of concatenated method names: 'r1hFhofpp5_s_zRHOu23tn3y65CHfhrQP6hDZLEZMGUMMtve7BH', 'Js6rNp3j8smAsl1hz_q_Ee01cOx4AZYDurjpwy5kIn', 'e2twXp3sPhgvVlejpBIedfkXTcY0AB0jS2Yr5UW2eO06o4mlIpO4p6rfnJDVfTp8J4Yw_DQ6TINxnaYUD7qJFr2LKJB', 'xSsY2lWIoCu8SiQRigcWIQrhrwBTIBGEFqb01oOluYa7_mIQwKnUBaub0k9nzFzdU', 'PlP2rCu_QKO90jkJvqQUlkvdt7GVNm90Z5lwxgXnnW_jEZOc2oYh9VI3OGd8ZhqTnnfbdSKi3O3Jy4', 'Tr6fV3MlzHs0Eyk0Xh_nLiehgSUNYQ5gbPOfIoq7cnJNQ6Yeo7EBq', 'CG1YWJzxlwDM6JKUucxUTF2RLjG6bulOcMvaqCEFhJ8UQY01KKSenEikD', 'rL6kMVm9rk40RukdWlwBpBRoLLlcfwuIPY2xRt1A3SMH96876msvIf73BB3fsPt_1Z6KHkfJ1IeZeQhF_WO2RIabVIElYt3b7R4sscTXEQaVWcfamOpfbS', 'AFzWEbjHJT01jpIGEAI0YxTBqys9ySdXH4KWIQHGm2UbCG_DzJFw8diYVRPwerrY_B5Y1VV5Y0O13iY45eL_2', 'Dpkm3AfHdbHIRqxJJ3DCNCzflqa8d5NnbXMRPk59L8pcKibaGGUSgTTXM28mTs0YMfgNt8'
Source: N00LMS9L.dll, awlq6Wtkzz2kbac_rdWdKHJA1_XkowSzfxjkYjJlpfQ9mTv80qAu8j1yA8GNs842KQUdjw6lVjiy_P9U1jMkZ577nf.cs High entropy of concatenated method names: 'Q3cQguhygkfPEUeyNNEzAfXza5D4w0FOaiWI3O20Html9Z66Sm_6Nf', 'kDtHWfoH6nvZLwqXjNFaV5DDbO_aQq3gQ_Qsjm8LmtQWaWe0Hjx9ygBqrFitKSOV5GeYXqxe8RD0uzTXC4', 'gcxf5bwfO6nVrvr6kMR9sZjAGB4KfHzU8HcVjVTCasZP9mQTZyLnNpAZzD9riEoeL9aig86n1GnUB7Ao6XSwtZYrz7YoxL', 'wM7MzkaoPyBN12VCfPV9zkv1eetZPKg9BZJA1p3GUFgSjRkXmGurTNilSpZD', 'Kj3U3iwrxgIs0emheNTVtipOh_MzrXqSP7A6Ou9vJ5ahhaz81o6G2ETtrLDi0KWi8FJVPwx_K9HaOS5WxsNPLVMQnMIHq11gM4xpa', 'cI7wuImepKeOr8SZ9m4yRseqRosN3rdoJAi3bHirFke2DtfC9iFmHlFAdZTdXTMlj5d', 'PCW4CjSuI1nAFujuwbdlUZ5maFtq9zVC6vn8Th8rybJmzNs8yMwv0wwn9gzGkIKwoddxEFQytgr5OVN6k'
Source: N00LMS9L.dll, UybYQBIsrITfuGXrXBQhA0RvoqHogkO7S57MfWrWgDxzX8.cs High entropy of concatenated method names: 'Is', 'dKjvfneCSknjcFXxnXVSLnrv2BpEXTG6LOokUrrJl68nQI4Rro9rjpQlk', 'PVui2txtqYkaMPDlesKv2ABLB4RSHifUY3cRTynbWm5AQ', 'oocDCxpG8ZRMwQ5g4wedKdMjVvjBhHZ7fSoXrnfCOFb3MXGO2yQLGVOw0dT5DOlwQFrOBHvKo8RzjTKRnkSBdB1N6AxqY2D', 'VKPQT0qSocM9wb7bLS6ncckDNdZwAusuSE4U1GCVc8zEz9DDtcP8TxZgcvVULuGqBCTwmp9gYiS4zA', 'KouWrkDy1PieQlBM_O7iNus9MJ8bm0fFANqunZyav', 'SNA6sN4Rk3lcmisU0tRFbJuTMa45vFdSVrlRRW_zxuC9U4dsSidFc_aMmB', 'JebQU_dgMHa9SE0fDixjfh03Hk64mOiJvI5PrXDXA6rGFHSBC7BMNygFmo06m7', 'iP0nyh3GrWgvhpGG0j_6MDbbZ117JA_n2lovPC07ryMCgDNgzdlP674NOLjAmYOorMBeDIXwhoP6MLiRQtL0SHBJcMcv8UKeWa5coOD', 'fnRTtjJcj2puqwgp8cwhuIwfFrfs2OQe8s1a89f6PN5OjQFMacDvSn8gxAUGGit9q01NA5s'
Source: N00LMS9L.dll, QNAzOd5Ms0XE7cAb5.cs High entropy of concatenated method names: 'RXzLdYPZdL6oSzfmKWY9MjiTGWpoLbwl3iKWcyHrazpaDUdMES1bBxw0BKKv6gupQ7WioJOP6bDnwHYhuC_uiUlT', 'hDqV963QsGzYu3xF14ROTa4fVTFE_I', 'i8UrElCzaG3', 'wgfwZSXluci1ioidrsx9ilqdXTejOfkVB7yqVVIMkqgUMBY8eVUGaZdSu', 'dQAtwT8jZ9IhnOZhEZkEW82PaKD3'
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe Thread delayed: delay time: 120000 Jump to behavior
Source: N00LMS9L.dll Binary or memory string: kuHGfS8GypYFNk20xQP38utwtMPmvOa2WkY0iyNcQswhpwEylGgsZ5vvrpUpGj5l4Rf2vEYE34sX9_9TbKajfPuTplLWHkxv1wBshASPOX0fu6
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\N00LMS9L.dll",#1 Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Jupyter
Source: Yara match File source: N00LMS9L.dll, type: SAMPLE

Remote Access Functionality
barindex
Yara detected Jupyter
Source: Yara match File source: N00LMS9L.dll, type: SAMPLE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1417190 Sample: N00LMS9L.dll Startdate: 28/03/2024 Architecture: WINDOWS Score: 52 15 Yara detected Jupyter 2->15 17 Sample uses string decryption to hide its real strings 2->17 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        process5 13 rundll32.exe 9->13         started       
⊘No contacted IP infos