Analysis
- max time kernel
152s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
20/12/2023, 16:48
General
- Target ed138003e29a2346ac92922ac278e712.exe
- Size 272KB
- Sample231220-va38ksabb7
- SHA256 9cc39336d3c70ccc30c6055ac389305ddaa8a5b32a9ab948e132776ba5f84bdf
Malware Config
Extracted
-
growtopia
-
payload_url
https://cdn.discordapp.com/attachments/819331742212161576/877226130640343090/newlog.gif
https://cdn.discordapp.com/attachments/819331742212161576/877227264864055327/clipboard.gif
https://cdn.discordapp.com/attachments/819331742212161576/877216643896459294/clipboard.gif
https://cdn.discordapp.com/attachments/819331742212161576/877223646391844904/savedat.gif
https://cdn.discordapp.com/attachments/819331742212161576/877225829988438026/growtopia.gif
Signatures
- Growtopia
Growtopa is an opensource modular stealer written in C#.
- Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed138003e29a2346ac92922ac278e712.exe"C:\Users\Admin\AppData\Local\Temp\ed138003e29a2346ac92922ac278e712.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 8642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4260 -ip 42601⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4260-0-0x0000000074E70000-0x0000000075620000-memory.dmp
memory/4260-1-0x0000000000A10000-0x0000000000A58000-memory.dmp
memory/4260-2-0x0000000074E70000-0x0000000075620000-memory.dmp
memory/4260-3-0x0000000074E70000-0x0000000075620000-memory.dmp