| File name: | Little Injector.exe |
| Full analysis: | https://app.any.run/tasks/585ba9d5-1a8f-440d-91f7-d67e49f42169 |
| Verdict: | Malicious activity |
| Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
| Analysis date: | August 21, 2020, 21:55:54 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | CC14CEDE3592750CE4790099BCD22645 |
| SHA1: | 9B1B70BBABCE8E09519664EBD93D56A771CC15EB |
| SHA256: | 7B450649EC87E814D0292371EAA421C1ABEF4A0BBDD32023C7F75D796E695903 |
| SSDEEP: | 6144:sLV6Bta6dtJmakIM57cGLYiO5C3e6s7338vSJ:sLV6BtpmkSYiOS1k3TJ |
MALICIOUS
NANOCORE was detected
- Little Injector.exe (PID: 2912)
Changes the autorun value in the registry
- Little Injector.exe (PID: 2912)
- Little Injector.exe (PID: 3528)
Uses Task Scheduler to run other applications
- Little Injector.exe (PID: 3528)
Loads the Task Scheduler COM API
- schtasks.exe (PID: 2796)
- schtasks.exe (PID: 1664)
SUSPICIOUS
Executable content was dropped or overwritten
- Little Injector.exe (PID: 2912)
- Little Injector.exe (PID: 3528)
Creates files in the user directory
- Little Injector.exe (PID: 2912)
- Little Injector.exe (PID: 3528)
Application launched itself
- Little Injector.exe (PID: 2912)
Creates files in the program directory
- Little Injector.exe (PID: 3528)
INFO
Manual execution by user
- taskmgr.exe (PID: 1940)
- opera.exe (PID: 2264)
Creates files in the user directory
- opera.exe (PID: 2264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (23.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.6) |
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2015:02:22 01:49:37+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 116736 |
| InitializedDataSize: | 90624 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1e792 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 22-Feb-2015 00:49:37 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000080 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 3 |
| Time date stamp: | 22-Feb-2015 00:49:37 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00002000 | 0x0001C798 | 0x0001C800 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.59803 |
.reloc | 0x00020000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.10191 |
.rsrc | 0x00022000 | 0x00015FC8 | 0x00016000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.99761 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 7.99775 | 89968 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
Imports
mscoree.dll |
Total processes
46
Monitored processes
6
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1664 | "schtasks.exe" /create /f /tn "TCP Monitor Task" /xml "C:\Users\admin\AppData\Local\Temp\tmp14D7.tmp" | C:\Windows\system32\schtasks.exe | — | Little Injector.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1940 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2264 | "C:\Program Files\Opera\opera.exe" | C:\Program Files\Opera\opera.exe | explorer.exe | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Exit code: 0 Version: 1748 Modules
| |||||||||||||||
| 2796 | "schtasks.exe" /create /f /tn "TCP Monitor" /xml "C:\Users\admin\AppData\Local\Temp\tmp1449.tmp" | C:\Windows\system32\schtasks.exe | — | Little Injector.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2912 | "C:\Users\admin\AppData\Local\Temp\Little Injector.exe" | C:\Users\admin\AppData\Local\Temp\Little Injector.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3528 | "C:\Users\admin\AppData\Local\Temp\Little Injector.exe" | C:\Users\admin\AppData\Local\Temp\Little Injector.exe | Little Injector.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
Total events
604
Read events
539
Write events
64
Delete events
1
Modification events
| (PID) Process: | (2912) Little Injector.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | TCP Monitor |
Value: C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exe | |||
| (PID) Process: | (2912) Little Injector.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2912) Little Injector.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3528) Little Injector.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | TCP Monitor |
Value: C:\Program Files\TCP Monitor\tcpmon.exe | |||
| (PID) Process: | (3528) Little Injector.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | delete value | Name: | TCP Monitor |
Value: C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exe | |||
| (PID) Process: | (2264) opera.exe | Key: | HKEY_CURRENT_USER\Software\Opera Software |
| Operation: | write | Name: | Last CommandLine v2 |
Value: C:\Program Files\Opera\opera.exe | |||
| (PID) Process: | (2264) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
Executable files
2
Suspicious files
24
Text files
5
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3528 | Little Injector.exe | C:\Users\admin\AppData\Local\Temp\tmp14D7.tmp | — | |
MD5:— | SHA256:— | |||
| 2264 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\oprD836.tmp | — | |
MD5:— | SHA256:— | |||
| 2264 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\oprD875.tmp | — | |
MD5:— | SHA256:— | |||
| 2264 | opera.exe | C:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00001.tmp | — | |
MD5:— | SHA256:— | |||
| 2264 | opera.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RTIDXYHXNJS0477F2E38.temp | — | |
MD5:— | SHA256:— | |||
| 2912 | Little Injector.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dat | binary | |
MD5:— | SHA256:— | |||
| 2912 | Little Injector.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exe | executable | |
MD5:— | SHA256:— | |||
| 3528 | Little Injector.exe | C:\Users\admin\AppData\Local\Temp\tmp1449.tmp | xml | |
MD5:— | SHA256:— | |||
| 2264 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat | binary | |
MD5:— | SHA256:— | |||
| 2264 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
5
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2264 | opera.exe | GET | 200 | 93.184.220.29:80 | http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl | US | der | 592 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3528 | Little Injector.exe | 152.250.130.1:5552 | thecowserver.ddns.net | TELEFÔNICA BRASIL S.A | BR | unknown |
2264 | opera.exe | 185.26.182.93:443 | certs.opera.com | Opera Software AS | — | whitelisted |
3528 | Little Injector.exe | 8.8.8.8:53 | — | Google Inc. | US | malicious |
2264 | opera.exe | 93.184.220.29:80 | crl4.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
thecowserver.ddns.net |
| malicious |
certs.opera.com |
| whitelisted |
crl4.digicert.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3528 | Little Injector.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |
3528 | Little Injector.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |
3528 | Little Injector.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |