Behavioral task
behavioral1
Sample
1620-64-0x0000000000D00000-0x000000000107A000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1620-64-0x0000000000D00000-0x000000000107A000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1620-64-0x0000000000D00000-0x000000000107A000-memory.dmp
-
Size
3.5MB
-
MD5
1c40e764e56d93f649eb6e179c2ce270
-
SHA1
5c7c68c06786ced549b2d3ced998822febd0bcca
-
SHA256
1409f2e87f7bc40c353ffbfd7391a1878d1fe2f34870444c624e5beca92235ad
-
SHA512
5f635afb3f4bd3e3762d25a16dfe53e324eaa5ebf34c7eb4c5f9242eeb60ed8a9cd69f36959fac4c9d5f3117e37b12d5c496ee57af72223076c4dacb1d8f34f8
-
SSDEEP
49152:4iuOWiU4mHnkkTdID5grG89delhZwQkYzx9qJ/:rJWiKkoI6rGHP2Yzx9G
Malware Config
Signatures
-
Njrat family
Files
-
1620-64-0x0000000000D00000-0x000000000107A000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 912KB - Virtual size: 912KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ