Behavioral task
behavioral1
Sample
1744-157-0x0000000000400000-0x000000000040C000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1744-157-0x0000000000400000-0x000000000040C000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1744-157-0x0000000000400000-0x000000000040C000-memory.dmp
-
Size
48KB
-
MD5
6c4a91e133ce97143c201d9e302c40cd
-
SHA1
3c381f8285420be2b6273e3336e0d7d201f403e2
-
SHA256
cb92c551fdc5aef72c7fc10ca596e17baeee77a2cb30de8902b0c87d1ea08722
-
SHA512
a04632cbcb86c83eb5ecc58273522c9f8368447f648609f777fe120e2695ed291dc1cecf245a5909e617154dadd572badfcdbdc82c868c2a37f32e549cd0fe26
-
SSDEEP
384:+0bUe5XB4e0XrODxggUBZIGFWT5tTUFQqzF1IObbT:vT9BuS9ggUBZIpAvbT
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
crazydns.linkpc.net:5900
d9590f01b48c43
-
reg_key
d9590f01b48c43
-
splitter
@!#&^%$
Signatures
-
Njrat family
Files
-
1744-157-0x0000000000400000-0x000000000040C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ