redtiger | 90c0151c7285ea8519e3584b2916dc769ff31f47a64585b9752b0e76107ceb06 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 17:56

Sharing

Report Analysis Logs

General

Target

securelookup.exe
Size

102.5MB
MD5

4865208982a2a067f80b6515ee5dbaa0
SHA1

10f66ba07b10ed54981c34dd62a5390579c0f84e
SHA256

90c0151c7285ea8519e3584b2916dc769ff31f47a64585b9752b0e76107ceb06
SHA512

e1b5a156b8ca80ca967d862f3205ff3b4fa6bdbaf90260fe685294e55415d3ea6b8965bc4919d7cc6e1bd362162984636bf003970141360ada575eaa93fbfa0a
SSDEEP

3145728:7V7pa8S6xjKcBa6c2qHO5iVY2nGQbRe0zJcBWSA49U:RVBSWNa6sHCiH1XcBWY

Score

10^/10

redtiger stealer

Malware Config

Signatures

Detects RedTiger Stealer 7 IoCs

resource	yara_rule
behavioral1/files/0x000400000001d39b-1252.dat	redtigerv122
behavioral1/files/0x000400000001d39b-1252.dat	redtigerv22
behavioral1/files/0x000400000001d39b-1252.dat	redtiger_stealer_detection
behavioral1/files/0x000400000001d39b-1252.dat	redtiger_stealer_detection_v2
behavioral1/files/0x000400000001d39b-1252.dat	staticSred
behavioral1/files/0x000400000001d39b-1252.dat	staticred
behavioral1/files/0x000400000001d39b-1252.dat	redtiger_stealer_detection_v1

Redtiger family
redtiger

Loads dropped DLL 1 IoCs

pid	Process
2744	securelookup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2744	2016	securelookup.exe	30
PID 2016 wrote to memory of 2744	2016	securelookup.exe	30
PID 2016 wrote to memory of 2744	2016	securelookup.exe	30

C:\Users\Admin\AppData\Local\Temp\securelookup.exe
"C:\Users\Admin\AppData\Local\Temp\securelookup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\securelookup.exe
  "C:\Users\Admin\AppData\Local\Temp\securelookup.exe"
  2⤵
  - Loads dropped DLL
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI20162\python312.dll

Filesize
6.6MB

MD5
d521654d889666a0bc753320f071ef60

SHA1
5fd9b90c5d0527e53c199f94bad540c1e0985db6

SHA256
21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2

SHA512
7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3

Download Submit