redtiger | 8f082b1939af2894fea681e6e807e577d15ea546fc0231f84720ac62867ca7f4

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06-01-2025 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ShareX-16.1.0-setup.exe
Size

39.2MB
MD5

996ca2860bf6737ecb4f469beaeadbcd
SHA1

7a7758afc19ab1eca1b3c2d8f11be630db9dce29
SHA256

8f082b1939af2894fea681e6e807e577d15ea546fc0231f84720ac62867ca7f4
SHA512

28bf3ebdf54fe17731306d5cb6230bb1dd7cd624822d71dd0172362a6cfd17b1237063d1d6af0576a92a4a2f60d06b4365a5cfd112a4f0bfd66dfbb1f292c525
SSDEEP

786432:o9ywSqdvSqwV58dq91FYTCb808MXYPnL9JCcC0ULVu:5rqd65Oi1sO0sYybLVu

Score

10^/10

redtiger discovery stealer

Malware Config

Signatures

Detects RedTiger Stealer 64 IoCs

stealer

resource	yara_rule
behavioral1/memory/828-2-0x0000000000401000-0x00000000004B7000-memory.dmp	redtigerv122
behavioral1/memory/828-2-0x0000000000401000-0x00000000004B7000-memory.dmp	redtigerv22
behavioral1/memory/828-2-0x0000000000401000-0x00000000004B7000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/828-2-0x0000000000401000-0x00000000004B7000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/828-2-0x0000000000401000-0x00000000004B7000-memory.dmp	staticSred
behavioral1/memory/828-2-0x0000000000401000-0x00000000004B7000-memory.dmp	staticred
behavioral1/memory/828-2-0x0000000000401000-0x00000000004B7000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/828-0-0x0000000000400000-0x00000000004D8000-memory.dmp	redtigerv122
behavioral1/memory/828-0-0x0000000000400000-0x00000000004D8000-memory.dmp	redtigerv22
behavioral1/memory/828-0-0x0000000000400000-0x00000000004D8000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/828-0-0x0000000000400000-0x00000000004D8000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/828-0-0x0000000000400000-0x00000000004D8000-memory.dmp	staticSred
behavioral1/memory/828-0-0x0000000000400000-0x00000000004D8000-memory.dmp	staticred
behavioral1/memory/828-0-0x0000000000400000-0x00000000004D8000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/files/0x0007000000016d55-4.dat	redtigerv122
behavioral1/files/0x0007000000016d55-4.dat	redtigerv22
behavioral1/files/0x0007000000016d55-4.dat	redtiger_stealer_detection
behavioral1/files/0x0007000000016d55-4.dat	redtiger_stealer_detection_v2
behavioral1/files/0x0007000000016d55-4.dat	staticSred
behavioral1/files/0x0007000000016d55-4.dat	staticred
behavioral1/files/0x0007000000016d55-4.dat	redtiger_stealer_detection_v1
behavioral1/memory/2596-9-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv122
behavioral1/memory/2596-9-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv22
behavioral1/memory/2596-9-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2596-9-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2596-9-0x0000000000400000-0x000000000071C000-memory.dmp	staticSred
behavioral1/memory/2596-9-0x0000000000400000-0x000000000071C000-memory.dmp	staticred
behavioral1/memory/2596-9-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/828-10-0x0000000000400000-0x00000000004D8000-memory.dmp	redtigerv122
behavioral1/memory/828-10-0x0000000000400000-0x00000000004D8000-memory.dmp	redtigerv22
behavioral1/memory/828-10-0x0000000000400000-0x00000000004D8000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/828-10-0x0000000000400000-0x00000000004D8000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/828-10-0x0000000000400000-0x00000000004D8000-memory.dmp	staticSred
behavioral1/memory/828-10-0x0000000000400000-0x00000000004D8000-memory.dmp	staticred
behavioral1/memory/828-10-0x0000000000400000-0x00000000004D8000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/2596-12-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv122
behavioral1/memory/2596-12-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv22
behavioral1/memory/2596-12-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2596-12-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2596-12-0x0000000000400000-0x000000000071C000-memory.dmp	staticSred
behavioral1/memory/2596-12-0x0000000000400000-0x000000000071C000-memory.dmp	staticred
behavioral1/memory/2596-12-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/2596-14-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv122
behavioral1/memory/2596-14-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv22
behavioral1/memory/2596-14-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2596-14-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2596-14-0x0000000000400000-0x000000000071C000-memory.dmp	staticSred
behavioral1/memory/2596-14-0x0000000000400000-0x000000000071C000-memory.dmp	staticred
behavioral1/memory/2596-14-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/2596-16-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv122
behavioral1/memory/2596-16-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv22
behavioral1/memory/2596-16-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2596-16-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2596-16-0x0000000000400000-0x000000000071C000-memory.dmp	staticSred
behavioral1/memory/2596-16-0x0000000000400000-0x000000000071C000-memory.dmp	staticred
behavioral1/memory/2596-16-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/2596-18-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv122
behavioral1/memory/2596-18-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv22
behavioral1/memory/2596-18-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2596-18-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2596-18-0x0000000000400000-0x000000000071C000-memory.dmp	staticSred
behavioral1/memory/2596-18-0x0000000000400000-0x000000000071C000-memory.dmp	staticred
behavioral1/memory/2596-18-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/2596-20-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv122

Redtiger family
redtiger

Executes dropped EXE 1 IoCs

pid	Process
2596	ShareX-16.1.0-setup.tmp

Loads dropped DLL 1 IoCs

pid	Process
828	ShareX-16.1.0-setup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShareX-16.1.0-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShareX-16.1.0-setup.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2596	828	ShareX-16.1.0-setup.exe	30
PID 828 wrote to memory of 2596	828	ShareX-16.1.0-setup.exe	30
PID 828 wrote to memory of 2596	828	ShareX-16.1.0-setup.exe	30
PID 828 wrote to memory of 2596	828	ShareX-16.1.0-setup.exe	30
PID 828 wrote to memory of 2596	828	ShareX-16.1.0-setup.exe	30
PID 828 wrote to memory of 2596	828	ShareX-16.1.0-setup.exe	30
PID 828 wrote to memory of 2596	828	ShareX-16.1.0-setup.exe	30

C:\Users\Admin\AppData\Local\Temp\ShareX-16.1.0-setup.exe
"C:\Users\Admin\AppData\Local\Temp\ShareX-16.1.0-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:828
- C:\Users\Admin\AppData\Local\Temp\is-FSBJ3.tmp\ShareX-16.1.0-setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FSBJ3.tmp\ShareX-16.1.0-setup.tmp" /SL5="$60150,40178641,832512,C:\Users\Admin\AppData\Local\Temp\ShareX-16.1.0-setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-FSBJ3.tmp\ShareX-16.1.0-setup.tmp

Filesize
3.1MB

MD5
b4785446ce1811a74bb18e5ede9bd8a7

SHA1
b07ec5b82f1294a57120fbf80d0abc8d7fc4c40c

SHA256
d5a25a8b56fac4337d2feafea80afc3a3a8391b464f025b4d4dc3e27f1db7211

SHA512
5ab04cb2da93de77fb7505391421df63f692a8452b5cc8475acd2a4d899714adc331473e579e77ec93a9c75bdb93a20810390ea64bdcc1c571cb5ad08e316b8a

Download Submit
memory/828-10-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/828-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/828-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2596-18-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-24-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-14-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-16-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-9-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-20-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-22-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-12-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-26-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-28-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-30-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-32-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-34-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-36-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-38-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download