redtiger | 994685a1d3be43a03366b34ef1cae6eb0b0405ae2cd13b263dea9600d49c06e3 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09/01/2025, 09:45

Sharing

Report Analysis Logs

General

Target

Arkadia.v3.0.29.exe
Size

105KB
MD5

d51722a21059254d64cfd3408db1d418
SHA1

2de40dd259b2bb8439ae032bc84393ad5e586d49
SHA256

994685a1d3be43a03366b34ef1cae6eb0b0405ae2cd13b263dea9600d49c06e3
SHA512

78bb07d07ff5f47eeb647fe325605440d6915db5ed75ae3e0d6370fb49b305c8257a4e0d27959d52103273b3fb9a39d6df5f7d16f3f8de767888e29e46e7c3f3
SSDEEP

1536:i/7nE4BKK/IXdW/+k3XjgIu5629YLz82RkAkqv2:i/I4BrgNW/+CjSl9VIkAko2

Score

10^/10

redtiger stealer

Malware Config

Signatures

Detects RedTiger Stealer 7 IoCs

resource	yara_rule
behavioral1/memory/1764-1-0x0000000001160000-0x0000000001180000-memory.dmp	redtigerv122
behavioral1/memory/1764-1-0x0000000001160000-0x0000000001180000-memory.dmp	redtigerv22
behavioral1/memory/1764-1-0x0000000001160000-0x0000000001180000-memory.dmp	redtiger_stealer_detection
behavioral1/memory/1764-1-0x0000000001160000-0x0000000001180000-memory.dmp	redtiger_stealer_detection_v2
behavioral1/memory/1764-1-0x0000000001160000-0x0000000001180000-memory.dmp	staticSred
behavioral1/memory/1764-1-0x0000000001160000-0x0000000001180000-memory.dmp	staticred
behavioral1/memory/1764-1-0x0000000001160000-0x0000000001180000-memory.dmp	redtiger_stealer_detection_v1

Redtiger family
redtiger

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1068	1764	Arkadia.v3.0.29.exe	31
PID 1764 wrote to memory of 1068	1764	Arkadia.v3.0.29.exe	31
PID 1764 wrote to memory of 1068	1764	Arkadia.v3.0.29.exe	31

C:\Users\Admin\AppData\Local\Temp\Arkadia.v3.0.29.exe
"C:\Users\Admin\AppData\Local\Temp\Arkadia.v3.0.29.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1764 -s 500
  2⤵
  PID:1068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-0-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Filesize
4KB

Download
memory/1764-1-0x0000000001160000-0x0000000001180000-memory.dmp

Filesize
128KB

Download