Analysis

  • max time kernel
    152s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-01-2024 03:35

General

  • Target

    5a2b1ad3d3c828f03da52e4b0749c341.exe

  • Size

    28.0MB

  • MD5

    5a2b1ad3d3c828f03da52e4b0749c341

  • SHA1

    9b658b5595b547a488208aceed71726a25e9e1e5

  • SHA256

    c2b88dcf9ac7f6dc3d41e1e4c2f2376886ae60c456d5e4ff51049edc39046dd4

  • SHA512

    8bab42d5597ba0a17f479e203265b19e85b948851611a4734dd1ea7498934c1908a6f04d427e15e9e22d6f24db98772e9d3d68809e8cfa9f039a0f5fde5084fa

  • SSDEEP

    393216:IjazfFNKd6Q1m3ihIHi2xKAJUz2O6y94ruE3t1c8cTNjcy0Zh275H3P6I43ZpBWK:IubFK2q2xzxZpVdExoaVSI4rBF

Score
10/10

Malware Config

Signatures

  • Growtopia

    Growtopa is an opensource modular stealer written in C#.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a2b1ad3d3c828f03da52e4b0749c341.exe
    "C:\Users\Admin\AppData\Local\Temp\5a2b1ad3d3c828f03da52e4b0749c341.exe"
    1⤵
      PID:2588
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 1324
        2⤵
        • Program crash
        PID:636
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2588 -ip 2588
      1⤵
        PID:3188

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2588-0-0x00000000748F0000-0x00000000750A0000-memory.dmp

        Filesize

        7.7MB

      • memory/2588-1-0x0000000000910000-0x00000000042AC000-memory.dmp

        Filesize

        57.6MB

      • memory/2588-2-0x00000000748F0000-0x00000000750A0000-memory.dmp

        Filesize

        7.7MB

      • memory/2588-3-0x000000000D180000-0x000000000D190000-memory.dmp

        Filesize

        64KB

      • memory/2588-4-0x000000000D180000-0x000000000D190000-memory.dmp

        Filesize

        64KB

      • memory/2588-5-0x000000000D180000-0x000000000D190000-memory.dmp

        Filesize

        64KB

      • memory/2588-6-0x000000000D180000-0x000000000D190000-memory.dmp

        Filesize

        64KB

      • memory/2588-7-0x000000000D490000-0x000000000E31C000-memory.dmp

        Filesize

        14.5MB

      • memory/2588-8-0x000000000D180000-0x000000000D190000-memory.dmp

        Filesize

        64KB

      • memory/2588-9-0x000000000D180000-0x000000000D190000-memory.dmp

        Filesize

        64KB

      • memory/2588-10-0x000000000D180000-0x000000000D190000-memory.dmp

        Filesize

        64KB

      • memory/2588-11-0x000000000D180000-0x000000000D190000-memory.dmp

        Filesize

        64KB

      • memory/2588-12-0x00000000748F0000-0x00000000750A0000-memory.dmp

        Filesize

        7.7MB