Analysis

  • max time kernel
    172s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 06:39

General

  • Target

    5a2b1ad3d3c828f03da52e4b0749c341.exe

  • Size

    28.0MB

  • MD5

    5a2b1ad3d3c828f03da52e4b0749c341

  • SHA1

    9b658b5595b547a488208aceed71726a25e9e1e5

  • SHA256

    c2b88dcf9ac7f6dc3d41e1e4c2f2376886ae60c456d5e4ff51049edc39046dd4

  • SHA512

    8bab42d5597ba0a17f479e203265b19e85b948851611a4734dd1ea7498934c1908a6f04d427e15e9e22d6f24db98772e9d3d68809e8cfa9f039a0f5fde5084fa

  • SSDEEP

    393216:IjazfFNKd6Q1m3ihIHi2xKAJUz2O6y94ruE3t1c8cTNjcy0Zh275H3P6I43ZpBWK:IubFK2q2xzxZpVdExoaVSI4rBF

Score
10/10

Malware Config

Signatures

  • Growtopia

    Growtopa is an opensource modular stealer written in C#.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a2b1ad3d3c828f03da52e4b0749c341.exe
    "C:\Users\Admin\AppData\Local\Temp\5a2b1ad3d3c828f03da52e4b0749c341.exe"
    1⤵
      PID:4496
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 1312
        2⤵
        • Program crash
        PID:4476
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4496 -ip 4496
      1⤵
        PID:1628

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4496-0-0x0000000075030000-0x00000000757E0000-memory.dmp

        Filesize

        7.7MB

      • memory/4496-1-0x0000000000D80000-0x000000000471C000-memory.dmp

        Filesize

        57.6MB

      • memory/4496-2-0x0000000075030000-0x00000000757E0000-memory.dmp

        Filesize

        7.7MB

      • memory/4496-3-0x000000000D8D0000-0x000000000D8E0000-memory.dmp

        Filesize

        64KB

      • memory/4496-4-0x0000000008B90000-0x0000000008B91000-memory.dmp

        Filesize

        4KB

      • memory/4496-5-0x0000000008B90000-0x0000000008B91000-memory.dmp

        Filesize

        4KB

      • memory/4496-6-0x000000000D8D0000-0x000000000D8E0000-memory.dmp

        Filesize

        64KB

      • memory/4496-7-0x0000000008B90000-0x0000000008B91000-memory.dmp

        Filesize

        4KB

      • memory/4496-8-0x0000000008B90000-0x0000000008B91000-memory.dmp

        Filesize

        4KB

      • memory/4496-9-0x0000000008B90000-0x0000000008B91000-memory.dmp

        Filesize

        4KB

      • memory/4496-10-0x000000000D8E0000-0x000000000E76C000-memory.dmp

        Filesize

        14.5MB

      • memory/4496-11-0x0000000075030000-0x00000000757E0000-memory.dmp

        Filesize

        7.7MB