Overview

overview

10

Static

static

10

VapeV4.exe

windows10-2004-x64

10

NiceRAT.pyc

windows10-2004-x64

10

Analysis

  • max time kernel
    8s
  • max time network
    3s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2024 13:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VapeV4.exe

  • Size

    20.3MB

  • MD5

    13a7bbd10551aaec3443b20cb3afbebd

  • SHA1

    3fd00a5d0faba6d684bdaaf87df1fc81095faa15

  • SHA256

    781a9255db93078bb36ea38c2b9a073eacf03f142693b51b7f257d7f8f1fb76e

  • SHA512

    f6f57901ec1ec791b601de3fea98639d5b59f2ef2e219c40590709ab4902b6d342f89ff44be39ed90c6758a275753002c4e595e1146aa957c97566b74098e76e

  • SSDEEP

    393216:kEkZQtss27GjJWQsUcR4NzQW+eGQRg93iObIhRS/MLzrqT6oHd8XTv/:khQtsAjYQFIW+e5R49MhR93ePyXT

Score
10/10
redtigerstealer

Malware Config

Signatures

  • Detects RedTiger Stealer 21 IoCs
    stealer
  • Redtiger family
    redtiger
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VapeV4.exe
    "C:\Users\Admin\AppData\Local\Temp\VapeV4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Users\Admin\AppData\Local\Temp\VapeV4.exe
      "C:\Users\Admin\AppData\Local\Temp\VapeV4.exe"
      2⤵
      • Loads dropped DLL
      PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI6362\VCRUNTIME140.dll
    Filesize

    106KB

    MD5

    4585a96cc4eef6aafd5e27ea09147dc6

    SHA1

    489cfff1b19abbec98fda26ac8958005e88dd0cb

    SHA256

    a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

    SHA512

    d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI6362\base_library.zip
    Filesize

    1.4MB

    MD5

    d220b7e359810266fe6885a169448fa0

    SHA1

    556728b326318b992b0def059eca239eb14ba198

    SHA256

    ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d

    SHA512

    8f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI6362\python311.dll
    Filesize

    5.5MB

    MD5

    65e381a0b1bc05f71c139b0c7a5b8eb2

    SHA1

    7c4a3adf21ebcee5405288fc81fc4be75019d472

    SHA256

    53a969094231b9032abe4148939ce08a3a4e4b30b0459fc7d90c89f65e8dcd4a

    SHA512

    4db465ef927dfb019ab6faec3a3538b0c3a8693ea3c2148fd16163bf31c03c899dfdf350c31457edf64e671e3cc3e46851f32f0f84b267535bebc4768ef53d39

    Download Submit