growtopia | 131900cf883be291d9ed9de85a58e8d81344678f7ffe905775d69e7739783cfd

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 04:09

Target

453f05672ca9c2d90085f8415ea95239.exe
Size

269KB
MD5

453f05672ca9c2d90085f8415ea95239
SHA1

06ca0d72c1202ab27a571d42c89b42a578e77a23
SHA256

131900cf883be291d9ed9de85a58e8d81344678f7ffe905775d69e7739783cfd
SHA512

be070fc309b33d5c37781c1834ed1f605d0ab7ba6d72a9d6e7c3820767eff9b9646c41ff772a6d5ca3f68d080f0d7ea78badb9d7722e3ea4336e637615162837
SSDEEP

6144:/F2Lspq/ANuj0xCrD/nALeBDLqiRTON/vY47++tfMC4R/utYa99S2UH8:CMLeVLqiR+X7v7EW6a99E8

Score

10^/10

growtopia stealer

Family

growtopia

https://discord.com/api/webhooks/880777158702817320/wkNpRYNpGVphlIMAvZ57eu_vhi6EtJ-ZVob6G2nuT7eMLzq9RVKRWLcUe1YgsP2sQsFp

Attributes

payload_url
https://cdn.discordapp.com/attachments/819331742212161576/877226130640343090/newlog.gif

https://cdn.discordapp.com/attachments/819331742212161576/877227264864055327/clipboard.gif

https://cdn.discordapp.com/attachments/819331742212161576/877216643896459294/clipboard.gif

https://cdn.discordapp.com/attachments/819331742212161576/877223646391844904/savedat.gif

https://cdn.discordapp.com/attachments/819331742212161576/877225829988438026/growtopia.gif

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2224	2976	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

453f05672ca9c2d90085f8415ea95239.exe

description	pid	Process	procid_target
PID 2976 wrote to memory of 2224	2976	453f05672ca9c2d90085f8415ea95239.exe	16
PID 2976 wrote to memory of 2224	2976	453f05672ca9c2d90085f8415ea95239.exe	16
PID 2976 wrote to memory of 2224	2976	453f05672ca9c2d90085f8415ea95239.exe	16
PID 2976 wrote to memory of 2224	2976	453f05672ca9c2d90085f8415ea95239.exe	16

C:\Users\Admin\AppData\Local\Temp\453f05672ca9c2d90085f8415ea95239.exe
"C:\Users\Admin\AppData\Local\Temp\453f05672ca9c2d90085f8415ea95239.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 548
  2⤵
  - Program crash
  PID:2224

memory/2976-0-0x0000000000A80000-0x0000000000AC8000-memory.dmp

Filesize
288KB

Download
memory/2976-1-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2976-2-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download