growtopia | 793269815c27f60e5b69d7cae42b9fc93e07c20d07deba8fe919cd63e8d8339b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 13:50

Target

bd37c5595ec2d2fc099660be7645ab99.exe
Size

272KB
MD5

bd37c5595ec2d2fc099660be7645ab99
SHA1

4f4114cfa40659b89d0ac8479687dde37307f97a
SHA256

793269815c27f60e5b69d7cae42b9fc93e07c20d07deba8fe919cd63e8d8339b
SHA512

f61676465c69a04f62fa28ae3bc1cb4267d9f9fd3341a67a264e11c97c4defb2ebc6817128a32786cdb04e5b708a61b846af0fe27a55d558d59f5303b57a2783
SSDEEP

6144:1EZhl/cALHzDLqiRTON/vY47++t1MC4R/utYa99S2UH8:KZhLLH3LqiR+X7vdEW6a99E8

Score

10^/10

growtopia stealer

Family

growtopia

Attributes

payload_url
https://cdn.discordapp.com/attachments/819331742212161576/877226130640343090/newlog.gif

https://cdn.discordapp.com/attachments/819331742212161576/877227264864055327/clipboard.gif

https://cdn.discordapp.com/attachments/819331742212161576/877216643896459294/clipboard.gif

https://cdn.discordapp.com/attachments/819331742212161576/877223646391844904/savedat.gif

https://cdn.discordapp.com/attachments/819331742212161576/877225829988438026/growtopia.gif

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1668	2408	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bd37c5595ec2d2fc099660be7645ab99.exe

description	pid	Process	procid_target
PID 2408 wrote to memory of 1668	2408	bd37c5595ec2d2fc099660be7645ab99.exe	28
PID 2408 wrote to memory of 1668	2408	bd37c5595ec2d2fc099660be7645ab99.exe	28
PID 2408 wrote to memory of 1668	2408	bd37c5595ec2d2fc099660be7645ab99.exe	28
PID 2408 wrote to memory of 1668	2408	bd37c5595ec2d2fc099660be7645ab99.exe	28

C:\Users\Admin\AppData\Local\Temp\bd37c5595ec2d2fc099660be7645ab99.exe
"C:\Users\Admin\AppData\Local\Temp\bd37c5595ec2d2fc099660be7645ab99.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 548
  2⤵
  - Program crash
  PID:1668

memory/2408-0-0x0000000000FB0000-0x0000000000FF8000-memory.dmp

Filesize
288KB

Download
memory/2408-1-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/2408-2-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download