growtopia | e036d16a53d179cf0b5e858fde2e96ddba3befe70cb12506d4a5950fa57e23ba

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 14:30

Target

c434b38040123658d8d128523679b228.exe
Size

269KB
MD5

c434b38040123658d8d128523679b228
SHA1

8695122058bf808c11844dbbff16939bd1e676e7
SHA256

e036d16a53d179cf0b5e858fde2e96ddba3befe70cb12506d4a5950fa57e23ba
SHA512

a73e0d5ee8659dadaac18264aea341cdcc2872981fa29032353c2e90b4922aa02052ed063145ce4124ec7f73febf63c54f7bd30bc67cab8f82301082208477f5
SSDEEP

6144:Bhd+/cALHzDLqiRTON/vY47++t1MC4R/utYa99S2UH8:LdmLH3LqiR+X7vdEW6a99E8

Score

10^/10

growtopia stealer

Family

growtopia

https://discord.com/api/webhooks/885449685890899969/ygHzdLn35SVAO5CBlQh_Ygsr4OsM5Hag8mgXN7c5_FQPmXVx-XTGCQbdUv9K04fCR5n8

Attributes

payload_url
https://cdn.discordapp.com/attachments/819331742212161576/877226130640343090/newlog.gif

https://cdn.discordapp.com/attachments/819331742212161576/877227264864055327/clipboard.gif

https://cdn.discordapp.com/attachments/819331742212161576/877216643896459294/clipboard.gif

https://cdn.discordapp.com/attachments/819331742212161576/877223646391844904/savedat.gif

https://cdn.discordapp.com/attachments/819331742212161576/877225829988438026/growtopia.gif

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1204	2976	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c434b38040123658d8d128523679b228.exe

description	pid	Process	procid_target
PID 2976 wrote to memory of 1204	2976	c434b38040123658d8d128523679b228.exe	28
PID 2976 wrote to memory of 1204	2976	c434b38040123658d8d128523679b228.exe	28
PID 2976 wrote to memory of 1204	2976	c434b38040123658d8d128523679b228.exe	28
PID 2976 wrote to memory of 1204	2976	c434b38040123658d8d128523679b228.exe	28

C:\Users\Admin\AppData\Local\Temp\c434b38040123658d8d128523679b228.exe
"C:\Users\Admin\AppData\Local\Temp\c434b38040123658d8d128523679b228.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 548
  2⤵
  - Program crash
  PID:1204

memory/2976-0-0x0000000000D80000-0x0000000000DC8000-memory.dmp

Filesize
288KB

Download
memory/2976-1-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/2976-2-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download