tigerrat | 1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 09:56

Target
1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe
Size 457KB
Sample240410-lykayabd82
SHA256 1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392
MD5 4df757390adf71abdd084d3e9718c153
SHA1 00331e5f972a98755811c02ec47301336a824a34
SHA512 4590344d7dad82a4edf62d6262a8dc2c5dc2cf119c8b21831c93b7371118558defee813e1af360cba39cee3e0ede6c99f6e95da949270cc79ae76a9337c678ef
SSDEEP 6144:kDZSfTWQ2Rsgc4iqgjjjjjUwW7D4cs/5ZRBAD6rZbdQc8XAXz40R5SVt1WskvLOl:QZS7DbW705ZTu6Vd0wXk0RwL1OO+gZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tigerrat rat

Detects TigerRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/2748-0-0x000002361B380000-0x000002361B3C3000-memory.dmp	family_tigerrat
behavioral2/memory/2748-1-0x000002361B380000-0x000002361B3C3000-memory.dmp	family_tigerrat

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 1300	2748	1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe	93
PID 2748 wrote to memory of 1300	2748	1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe	93

C:\Users\Admin\AppData\Local\Temp\1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe
"C:\Users\Admin\AppData\Local\Temp\1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe
  2⤵
  PID:1300

memory/2748-0-0x000002361B380000-0x000002361B3C3000-memory.dmp

Download

memory/2748-1-0x000002361B380000-0x000002361B3C3000-memory.dmp

Download