Behavioral task
behavioral1
Sample
1364-55-0x00000000002B0000-0x00000000002CA000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1364-55-0x00000000002B0000-0x00000000002CA000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1364-55-0x00000000002B0000-0x00000000002CA000-memory.dmp
-
Size
104KB
-
MD5
c54c9ad25286efd4590998dd452f7d1a
-
SHA1
c5c09315da11a33e3383a86ade5a07ea1fed08fd
-
SHA256
71f869e2a3736f041c45d5b820b37c40a825a367d654978d6bc00bb741899834
-
SHA512
50a29109a80ac04edb9f3e9745a094b4066173b7b2480c108af17db25324f5103040bfcb7485510ad478c0568210224b105ca0fbcbb7f3e616938e1ad069b82a
-
SSDEEP
1536:UGa+efzGj1RwVTqMDp8S5wpOk3JCK6pFo4jM6fOpd/9nEh9TG8J8Rg:0zCQwpOk5CK6hO/9ES8J86
Malware Config
Extracted
njrat
0.7.3
Lime
assessment-epinions.at.playit.gg:24620
Client.exe
-
reg_key
Client.exe
-
splitter
123
Signatures
-
Njrat family
Files
-
1364-55-0x00000000002B0000-0x00000000002CA000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ