redtiger | 6ac1098c9fc4a8ebbe1beed77ecab46dd82f2f425817529f748a10201e3bed00

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/01/2025, 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acc-puller.exe
Size

23.8MB
MD5

90ffbb8d57cd36f910bab67eabcfaa62
SHA1

449d91f55289ce477e1990f9ea298c7391e46cfe
SHA256

6ac1098c9fc4a8ebbe1beed77ecab46dd82f2f425817529f748a10201e3bed00
SHA512

32508220d03fddd2685d5e22eb5d092a6be58c6004e4dc5df222c1f0e92dfd2d0f2a73baea0e55ed3d32fef9653bbb73e5c68114c198cdbb03bfb463955f33bc
SSDEEP

393216:r3EJU4rR+ydBgXLoXACaJ6mWyvhXUS+da:r3gUG+UG7oXAzJ6zyvl+da

Score

10^/10

redtiger discovery stealer upx

Malware Config

Signatures

Detects RedTiger Stealer 14 IoCs

stealer

resource	yara_rule
behavioral1/files/0x000500000001a529-88.dat	redtigerv122
behavioral1/files/0x000500000001a529-88.dat	redtigerv22
behavioral1/files/0x000500000001a529-88.dat	redtiger_stealer_detection
behavioral1/files/0x000500000001a529-88.dat	redtiger_stealer_detection_v2
behavioral1/files/0x000500000001a529-88.dat	staticSred
behavioral1/files/0x000500000001a529-88.dat	staticred
behavioral1/files/0x000500000001a529-88.dat	redtiger_stealer_detection_v1
behavioral1/memory/2652-90-0x0000000074280000-0x0000000074851000-memory.dmp	redtigerv122
behavioral1/memory/2652-90-0x0000000074280000-0x0000000074851000-memory.dmp	redtigerv22
behavioral1/memory/2652-90-0x0000000074280000-0x0000000074851000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2652-90-0x0000000074280000-0x0000000074851000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2652-90-0x0000000074280000-0x0000000074851000-memory.dmp	staticSred
behavioral1/memory/2652-90-0x0000000074280000-0x0000000074851000-memory.dmp	staticred
behavioral1/memory/2652-90-0x0000000074280000-0x0000000074851000-memory.dmp	redtiger_stealer_detection_v1

Redtiger family
redtiger

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000500000001a529-88.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2652	acc-puller.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001a529-88.dat	upx
behavioral1/memory/2652-90-0x0000000074280000-0x0000000074851000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acc-puller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acc-puller.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2652	3068	acc-puller.exe	30
PID 3068 wrote to memory of 2652	3068	acc-puller.exe	30
PID 3068 wrote to memory of 2652	3068	acc-puller.exe	30
PID 3068 wrote to memory of 2652	3068	acc-puller.exe	30

C:\Users\Admin\AppData\Local\Temp\acc-puller.exe
"C:\Users\Admin\AppData\Local\Temp\acc-puller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\acc-puller.exe
  "C:\Users\Admin\AppData\Local\Temp\acc-puller.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI30682\python312.dll

Filesize
1.5MB

MD5
62a2384d495761afcb74328b535b93fc

SHA1
f3806dd178f57ec74e8f3acced0fa167ced77661

SHA256
beb8ccc9326c6b82a4bfaac9fc9e83a04804bf2a8e1aed0bed4f3a5dd9f799cc

SHA512
92e45717c06eae45ae87ec3eaea3a0f02543908a46698f172c35eeddf74294edb8b705b5b49e45f20daff2e5a99fdc4410bae08aa07c8c3b1c202b8e1209c91e

Download Submit
memory/2652-90-0x0000000074280000-0x0000000074851000-memory.dmp

Filesize
5.8MB

Download