Behavioral task
behavioral1
Sample
1140-145-0x0000000000400000-0x000000000042C000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1140-145-0x0000000000400000-0x000000000042C000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1140-145-0x0000000000400000-0x000000000042C000-memory.dmp
-
Size
176KB
-
MD5
461bb1b9b0f8d5ff24337b07462fccec
-
SHA1
b4dfa34cb03b508386f472487ec212d260c449c1
-
SHA256
71f2f3f6a9837f800cf241a908881c9aa3984901f85da37fdf1b227f0c462265
-
SHA512
c9c54f256d09ebf124306569ff9599d89305fa6047f88b87ab58c602d9eb5fd23b9351a7b03be717ce057b4e30898ea7dceae6401da7df346b20a570eb6fa1ef
-
SSDEEP
3072:+bRR+0O5VbFHexuiCrK0ovzNC0Fie+5cVjvn+sZCh8/QbC768Y:+bRU0OLoxuiCNovpke+cvnOaQ38
Malware Config
Extracted
arrowrat
Client
185.246.221.202:17168
WcOErhAdu
Signatures
-
Arrowrat family
Files
-
1140-145-0x0000000000400000-0x000000000042C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 152KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ