redtiger | 8f082b1939af2894fea681e6e807e577d15ea546fc0231f84720ac62867ca7f4

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06/01/2025, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ShareX-16.1.0-setup.exe
Size 39.2MB
Sample250106-xva4mswrer
SHA256 8f082b1939af2894fea681e6e807e577d15ea546fc0231f84720ac62867ca7f4
MD5 996ca2860bf6737ecb4f469beaeadbcd
SHA1 7a7758afc19ab1eca1b3c2d8f11be630db9dce29
SHA512 28bf3ebdf54fe17731306d5cb6230bb1dd7cd624822d71dd0172362a6cfd17b1237063d1d6af0576a92a4a2f60d06b4365a5cfd112a4f0bfd66dfbb1f292c525
SSDEEP 786432:o9ywSqdvSqwV58dq91FYTCb808MXYPnL9JCcC0ULVu:5rqd65Oi1sO0sYybLVu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redtiger discovery stealer

Malware Config

Signatures

Detects RedTiger Stealer 64 IoCs

stealer

resource	yara_rule
behavioral1/memory/2988-0-0x0000000000400000-0x00000000004D8000-memory.dmp	redtigerv122
behavioral1/memory/2988-0-0x0000000000400000-0x00000000004D8000-memory.dmp	redtigerv22
behavioral1/memory/2988-0-0x0000000000400000-0x00000000004D8000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2988-0-0x0000000000400000-0x00000000004D8000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2988-0-0x0000000000400000-0x00000000004D8000-memory.dmp	staticSred
behavioral1/memory/2988-0-0x0000000000400000-0x00000000004D8000-memory.dmp	staticred
behavioral1/memory/2988-0-0x0000000000400000-0x00000000004D8000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/2988-2-0x0000000000401000-0x00000000004B7000-memory.dmp	redtigerv122
behavioral1/memory/2988-2-0x0000000000401000-0x00000000004B7000-memory.dmp	redtigerv22
behavioral1/memory/2988-2-0x0000000000401000-0x00000000004B7000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2988-2-0x0000000000401000-0x00000000004B7000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2988-2-0x0000000000401000-0x00000000004B7000-memory.dmp	staticSred
behavioral1/memory/2988-2-0x0000000000401000-0x00000000004B7000-memory.dmp	staticred
behavioral1/memory/2988-2-0x0000000000401000-0x00000000004B7000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/files/0x00080000000170f8-4.dat	redtigerv122
behavioral1/files/0x00080000000170f8-4.dat	redtigerv22
behavioral1/files/0x00080000000170f8-4.dat	redtiger_stealer_detection
behavioral1/files/0x00080000000170f8-4.dat	redtiger_stealer_detection_v2
behavioral1/files/0x00080000000170f8-4.dat	staticSred
behavioral1/files/0x00080000000170f8-4.dat	staticred
behavioral1/files/0x00080000000170f8-4.dat	redtiger_stealer_detection_v1
behavioral1/memory/2260-8-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv122
behavioral1/memory/2260-8-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv22
behavioral1/memory/2260-8-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2260-8-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2260-8-0x0000000000400000-0x000000000071C000-memory.dmp	staticSred
behavioral1/memory/2260-8-0x0000000000400000-0x000000000071C000-memory.dmp	staticred
behavioral1/memory/2260-8-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/2988-10-0x0000000000400000-0x00000000004D8000-memory.dmp	redtigerv122
behavioral1/memory/2988-10-0x0000000000400000-0x00000000004D8000-memory.dmp	redtigerv22
behavioral1/memory/2988-10-0x0000000000400000-0x00000000004D8000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2988-10-0x0000000000400000-0x00000000004D8000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2988-10-0x0000000000400000-0x00000000004D8000-memory.dmp	staticSred
behavioral1/memory/2988-10-0x0000000000400000-0x00000000004D8000-memory.dmp	staticred
behavioral1/memory/2988-10-0x0000000000400000-0x00000000004D8000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/2260-11-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv122
behavioral1/memory/2260-11-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv22
behavioral1/memory/2260-11-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2260-11-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2260-11-0x0000000000400000-0x000000000071C000-memory.dmp	staticSred
behavioral1/memory/2260-11-0x0000000000400000-0x000000000071C000-memory.dmp	staticred
behavioral1/memory/2260-11-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/2260-13-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv122
behavioral1/memory/2260-13-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv22
behavioral1/memory/2260-13-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2260-13-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2260-13-0x0000000000400000-0x000000000071C000-memory.dmp	staticSred
behavioral1/memory/2260-13-0x0000000000400000-0x000000000071C000-memory.dmp	staticred
behavioral1/memory/2260-13-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/2260-15-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv122
behavioral1/memory/2260-15-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv22
behavioral1/memory/2260-15-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2260-15-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2260-15-0x0000000000400000-0x000000000071C000-memory.dmp	staticSred
behavioral1/memory/2260-15-0x0000000000400000-0x000000000071C000-memory.dmp	staticred
behavioral1/memory/2260-15-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/2260-17-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv122
behavioral1/memory/2260-17-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv22
behavioral1/memory/2260-17-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/2260-17-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/2260-17-0x0000000000400000-0x000000000071C000-memory.dmp	staticSred
behavioral1/memory/2260-17-0x0000000000400000-0x000000000071C000-memory.dmp	staticred
behavioral1/memory/2260-17-0x0000000000400000-0x000000000071C000-memory.dmp	redtiger_stealer_detection_v1
behavioral1/memory/2260-19-0x0000000000400000-0x000000000071C000-memory.dmp	redtigerv122

Redtiger family
redtiger

Executes dropped EXE 1 IoCs

pid	Process
2260	ShareX-16.1.0-setup.tmp

Loads dropped DLL 1 IoCs

pid	Process
2988	ShareX-16.1.0-setup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShareX-16.1.0-setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShareX-16.1.0-setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2260	2988	ShareX-16.1.0-setup.exe	30
PID 2988 wrote to memory of 2260	2988	ShareX-16.1.0-setup.exe	30
PID 2988 wrote to memory of 2260	2988	ShareX-16.1.0-setup.exe	30
PID 2988 wrote to memory of 2260	2988	ShareX-16.1.0-setup.exe	30
PID 2988 wrote to memory of 2260	2988	ShareX-16.1.0-setup.exe	30
PID 2988 wrote to memory of 2260	2988	ShareX-16.1.0-setup.exe	30
PID 2988 wrote to memory of 2260	2988	ShareX-16.1.0-setup.exe	30

C:\Users\Admin\AppData\Local\Temp\ShareX-16.1.0-setup.exe
"C:\Users\Admin\AppData\Local\Temp\ShareX-16.1.0-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\is-RE6T2.tmp\ShareX-16.1.0-setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RE6T2.tmp\ShareX-16.1.0-setup.tmp" /SL5="$40156,40178641,832512,C:\Users\Admin\AppData\Local\Temp\ShareX-16.1.0-setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ShareX-16.1.0-setup.tmp

Path \Users\Admin\AppData\Local\Temp\is-RE6T2.tmp\ShareX-16.1.0-setup.tmp
Size 3.1MB
SHA256 d5a25a8b56fac4337d2feafea80afc3a3a8391b464f025b4d4dc3e27f1db7211
MD5 b4785446ce1811a74bb18e5ede9bd8a7
SHA1 b07ec5b82f1294a57120fbf80d0abc8d7fc4c40c
SHA512 5ab04cb2da93de77fb7505391421df63f692a8452b5cc8475acd2a4d899714adc331473e579e77ec93a9c75bdb93a20810390ea64bdcc1c571cb5ad08e316b8a
SSDEEP 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2260-25-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-23-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-8-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-37-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-11-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-13-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-15-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-17-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-35-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-19-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-21-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-33-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-27-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-29-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2260-31-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2988-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/2988-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/2988-10-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads