CmdID

CmdID / Files

nslookup.exe

nslookup file version info

Program on Windows 12 known copies with hashes 7 Sigma rules name it Command nslookup

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real nslookup.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
Descriptionnslookup

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\nslookup.exe · signed by Microsoft Windows

0f356ed144de50da823da1179c6c5e965fdd6071581bc6eaaf6ba49aa9c0521b

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\nslookup.exe · signed by Microsoft Windows

b4f470d8a59056bb07d754b8fafc77118ec03d383b643399ab73aab75b74e812

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\nslookup.exe · signed by Microsoft Windows

531a1b65e4e3869d65d2eaf6b07c92a34dd6fe18ed9a647bd1a257ab3d0c1aeb

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\nslookup.exe · signed by Microsoft Windows

55ab032d256adbe3fde40cf90fe83ba5eab591e04ad720161ed8e6ef059ca747

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\nslookup.exe · signed by Microsoft Windows

7ff4539922eadcff60675fc1a07fdeca8decb2e1faff4a9478e5fae51c71d505

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\nslookup.exe · signed by Microsoft Windows

8ce6eaa22dc0d9d14ec013334bd1403d98d14e492d3cce28ac63f033d3c9953f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\nslookup.exe · signed by Microsoft Windows

54daf167f8dbe7fe0f23b37a600bd8d9d16b756d3b83f0804b5037cbbe895eb6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\nslookup.exe · signed by Microsoft Windows

b137efebc097fda9311a4526e450238b07e15b6ea78f78b0c14c1eb073a171f6

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\nslookup.exe · signed by Microsoft Windows

24553bfab13871faf3ee6f1f8efecc5d25368a706a42ca35319228d3547418fa

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\nslookup.exe · signed by Microsoft Windows

eebd0be4886f640ce10cd99d2c8e64101b88a1a87391db226726b8390f7cba2e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\nslookup.exe · not signed

13c829643ef23ccbdc3675f1b015de74e8d3068b6ba871111ead7dcc025a558a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\nslookup.exe · not signed

eda6cd1bda685a38bb8d754c47710cb0bc2885990f174bdbf57028ad5a86dd22

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name nslookup.exe
criticalOilRig APT ActivityFlorian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
highPotential Process Injection Via Msra.EXEAlexander McDonald
highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems)
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
highWindows Shell/Scripting Processes Spawning Suspicious ProgramsFlorian Roth (Nextron Systems), Tim Shelton
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
mediumNslookup PowerShell Download Cradle - ProcessCreationNasreddine Bencherchali (Nextron Systems)