Resubmissions

18-10-2023 13:13

231018-qgagmagb56 10

18-10-2023 13:10

231018-qectzagb42 10

18-10-2023 13:06

231018-qcaa3agb24 10

Analysis

  • max time kernel
    153s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-10-2023 13:10

General

  • Target

    Eternity.exe

  • Size

    40.7MB

  • MD5

    dd25c1eb2ee26fae2e4e1514568f08a2

  • SHA1

    4e1c0cc2354510a550f54692449780b8e5613d01

  • SHA256

    feed95481351dc1e993cdb061ae0eb28bfe18bc46409d231ee1ddc5e7c538181

  • SHA512

    53554600d9f45271658a126a33a08ead6f15ac25736cdc85efaa9e9a831564626f3e42fdbb02f5c2891b743b0127b57e41db5b5857a558710619702d147e8e4f

  • SSDEEP

    786432:hzvsyBy7Mu30RZFaG4ZmI1XHMX+XJQripdhr:ayCMr3EG4TVHjZQr+hr

Score
10/10

Malware Config

Signatures

  • Growtopia

    Growtopa is an opensource modular stealer written in C#.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Eternity.exe
    "C:\Users\Admin\AppData\Local\Temp\Eternity.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:3184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\enet_managed_resource\enet-win32-x86.dll

    Filesize

    39KB

    MD5

    e13ef136485a33c8a5b719d75b0312df

    SHA1

    fb692915b0a73e796c5904e05d37f963baef88dd

    SHA256

    9d2d83667ab5c391fbb60a1249078d0e2b031573a72dc07b67b610178ee94e78

    SHA512

    b3d58a11fc17925316f437e67d4b394bb9b5749e92064fe87eda3e12962f3970416e180cd40c61419651ec611eae0ee9f91a795199689cdd4743678bb6d3dca2

  • memory/3184-5-0x0000000009730000-0x000000000AAB8000-memory.dmp

    Filesize

    19.5MB

  • memory/3184-20-0x00000000072D0000-0x00000000072E0000-memory.dmp

    Filesize

    64KB

  • memory/3184-3-0x0000000007160000-0x0000000007161000-memory.dmp

    Filesize

    4KB

  • memory/3184-4-0x0000000007160000-0x0000000007161000-memory.dmp

    Filesize

    4KB

  • memory/3184-0-0x0000000074510000-0x0000000074CC0000-memory.dmp

    Filesize

    7.7MB

  • memory/3184-6-0x000000000B070000-0x000000000B614000-memory.dmp

    Filesize

    5.6MB

  • memory/3184-7-0x000000000AB60000-0x000000000ABF2000-memory.dmp

    Filesize

    584KB

  • memory/3184-13-0x000000000AC90000-0x000000000ACAA000-memory.dmp

    Filesize

    104KB

  • memory/3184-23-0x00000000072D0000-0x00000000072E0000-memory.dmp

    Filesize

    64KB

  • memory/3184-2-0x00000000072D0000-0x00000000072E0000-memory.dmp

    Filesize

    64KB

  • memory/3184-8-0x000000000ACE0000-0x000000000ADB6000-memory.dmp

    Filesize

    856KB

  • memory/3184-14-0x000000000AF70000-0x000000000B01A000-memory.dmp

    Filesize

    680KB

  • memory/3184-15-0x0000000006CE0000-0x0000000006CEA000-memory.dmp

    Filesize

    40KB

  • memory/3184-16-0x000000000B910000-0x000000000B950000-memory.dmp

    Filesize

    256KB

  • memory/3184-17-0x0000000074510000-0x0000000074CC0000-memory.dmp

    Filesize

    7.7MB

  • memory/3184-18-0x00000000072D0000-0x00000000072E0000-memory.dmp

    Filesize

    64KB

  • memory/3184-19-0x000000006EFC0000-0x000000006EFD2000-memory.dmp

    Filesize

    72KB

  • memory/3184-1-0x0000000000010000-0x0000000002870000-memory.dmp

    Filesize

    40.4MB

  • memory/3184-21-0x0000000007160000-0x0000000007161000-memory.dmp

    Filesize

    4KB

  • memory/3184-9-0x000000000AB20000-0x000000000AB28000-memory.dmp

    Filesize

    32KB