growtopia | 9cc39336d3c70ccc30c6055ac389305ddaa8a5b32a9ab948e132776ba5f84bdf

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 16:48

Target

ed138003e29a2346ac92922ac278e712.exe
Size

272KB
MD5

ed138003e29a2346ac92922ac278e712
SHA1

651b0b92f62a82c3c3e5bfe7cc61f7d39bd9cfce
SHA256

9cc39336d3c70ccc30c6055ac389305ddaa8a5b32a9ab948e132776ba5f84bdf
SHA512

51435b840354bdc9042a60a47305b1c720672ca95dd12e0b4c60aa33335a41cfacdfaaa46be5ba4f23a76a8e535c442a66bd97d73f5fe7b68242ac7a24156a3e
SSDEEP

6144:HENhL/cALHzDLqiRTON/vY47++t1MC4R/utYa99S2UH8:kNhdLH3LqiR+X7vdEW6a99E8

Score

10^/10

growtopia stealer

Family

growtopia

Attributes

payload_url
https://cdn.discordapp.com/attachments/819331742212161576/877226130640343090/newlog.gif

https://cdn.discordapp.com/attachments/819331742212161576/877227264864055327/clipboard.gif

https://cdn.discordapp.com/attachments/819331742212161576/877216643896459294/clipboard.gif

https://cdn.discordapp.com/attachments/819331742212161576/877223646391844904/savedat.gif

https://cdn.discordapp.com/attachments/819331742212161576/877225829988438026/growtopia.gif

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	1724	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2692	1724	ed138003e29a2346ac92922ac278e712.exe	28
PID 1724 wrote to memory of 2692	1724	ed138003e29a2346ac92922ac278e712.exe	28
PID 1724 wrote to memory of 2692	1724	ed138003e29a2346ac92922ac278e712.exe	28
PID 1724 wrote to memory of 2692	1724	ed138003e29a2346ac92922ac278e712.exe	28

C:\Users\Admin\AppData\Local\Temp\ed138003e29a2346ac92922ac278e712.exe
"C:\Users\Admin\AppData\Local\Temp\ed138003e29a2346ac92922ac278e712.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 552
  2⤵
  - Program crash
  PID:2692

memory/1724-0-0x0000000000CE0000-0x0000000000D28000-memory.dmp

Filesize
288KB

Download
memory/1724-1-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/1724-2-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download