CmdID / Files

nltest.exe

Microsoft Logon Server Test Utility file version info

Program on Windows 15 known copies with hashes 9 Sigma rules name it

Is it the real nltest.exe?

file version info and known copies

Original namenltestrk.exe in the file’s header: a renamed copy still carries it

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft Logon Server Test Utility

15 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\nltest.exe · signed by Microsoft Windows

f40c2711925df928fcc3cce781296922741b3b585b71e41fc9faa4404bd3c5e7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\nltest.exe · signed by Microsoft Windows

171202183676b30c00b4d25438e64c565978b7dcf0dfc17a2f1990a237e7c11b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\nltest.exe · signed by Microsoft Windows

214215c05ca777417c9adb9862cb40aafe66cbadf85e838e8318a2064793afd4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\nltest.exe · signed by Microsoft Windows

a0ab27588baa72c13f1bdd3a59cc6b76b1c9789ef9e30f0b8bef968316be77b5

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\nltest.exe · signed by Microsoft Windows

7fadd9db73f868040413c2b0466c9f4898372224e83c712f3a7a1494b8f66992

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\nltest.exe · signed by Microsoft Windows

246aabcefcf3d661d6966fcbf09e70d6f0862aa51b696990331d073a3693f5f6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\nltest.exe · signed by Microsoft Windows

4e8aa26ad71243d13f7ec156c31acbf1a0f1041303570e4e5cb910cc6d990567

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\nltest.exe · signed by Microsoft Windows

67667be06e369fd7b62328bfe70de34c34b40c2fa5837a8d241d59b37822ecc1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\nltest.exe · signed by Microsoft Windows

7dc93701dfdafc68c810d73924c7b4074b60d0ad1da90643d7def903836a0d37

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\nltest.exe · signed by Microsoft Windows

84ac73561a97a8d5ea4be2b817f9a0033c4a827a1e935f21aa703f040934db3b

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\SysWOW64\nltest.exe · signed by Microsoft Windows

f9a6cf4eb628c0c62c9c709975f21f7a249322ed6b0943825a5c49458e8e1338

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\nltest.exe · signed by Microsoft Windows

d9cd21bea4ef9ebb9bca97bf60bede70a20ced63a3f0300fb1e35c7b2d1a8df6

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\nltest.exe · signed by Microsoft Windows

e796f7d2d7d94c4cc3bf86fa39477ba37fcf4cb8fef3dd0161da6da2c58f6077

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\nltest.exe · not signed

03ad844d4fb53d807e2d440a088e77ff3329f8817565cf097d06ac269e711bff

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\nltest.exe · not signed

9f7be873d8f6efbfe909056a69f3d83f48f6e585ba0ecef7066d45817868b967

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name nltest.exe

criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)

highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highSuspicious Child Process Of SQL ServerFPT.EagleEye Team, wagga

highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)

highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)

mediumPotential Recon Activity Via Nltest.EXECraig Young, oscd.community, Georg Lauenstein

mediumPotentially Suspicious Child Process Of ClickOnce ApplicationNasreddine Bencherchali (Nextron Systems)

mediumRemote Access Tool - ScreenConnect Potential Suspicious Remote Command ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale

lowNltest.EXE ExecutionArun Chauhan