tigerrat | 1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392

Analysis

max time kernel
149s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
20/10/2025, 03:14

Target
1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe
Size 457KB
Sample251020-drkdcszlgl
SHA256 1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392
MD5 4df757390adf71abdd084d3e9718c153
SHA1 00331e5f972a98755811c02ec47301336a824a34
SHA512 4590344d7dad82a4edf62d6262a8dc2c5dc2cf119c8b21831c93b7371118558defee813e1af360cba39cee3e0ede6c99f6e95da949270cc79ae76a9337c678ef
SSDEEP 6144:kDZSfTWQ2Rsgc4iqgjjjjjUwW7D4cs/5ZRBAD6rZbdQc8XAXz40R5SVt1WskvLOl:QZS7DbW705ZTu6Vd0wXk0RwL1OO+gZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tigerrat rat

Detects TigerRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/368-1-0x0000025F3B510000-0x0000025F3B553000-memory.dmp	family_tigerrat
behavioral2/memory/368-2-0x0000025F3B510000-0x0000025F3B553000-memory.dmp	family_tigerrat

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 3008	368	1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe	79
PID 368 wrote to memory of 3008	368	1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe	79

C:\Users\Admin\AppData\Local\Temp\1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe
"C:\Users\Admin\AppData\Local\Temp\1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe
  2⤵
  PID:3008

memory/368-1-0x0000025F3B510000-0x0000025F3B553000-memory.dmp

Download

memory/368-2-0x0000025F3B510000-0x0000025F3B553000-memory.dmp

Download