growtopia | feed95481351dc1e993cdb061ae0eb28bfe18bc46409d231ee1ddc5e7c538181

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-02-2024 16:04

Target

Eternity.exe
Size

40.7MB
MD5

dd25c1eb2ee26fae2e4e1514568f08a2
SHA1

4e1c0cc2354510a550f54692449780b8e5613d01
SHA256

feed95481351dc1e993cdb061ae0eb28bfe18bc46409d231ee1ddc5e7c538181
SHA512

53554600d9f45271658a126a33a08ead6f15ac25736cdc85efaa9e9a831564626f3e42fdbb02f5c2891b743b0127b57e41db5b5857a558710619702d147e8e4f
SSDEEP

786432:hzvsyBy7Mu30RZFaG4ZmI1XHMX+XJQripdhr:ayCMr3EG4TVHjZQr+hr

Score

10^/10

growtopia stealer

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1372	2224	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Eternity.exe

description	pid	Process
Token: SeDebugPrivilege	2224	Eternity.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Eternity.exe

description	pid	Process	procid_target
PID 2224 wrote to memory of 1372	2224	Eternity.exe	28
PID 2224 wrote to memory of 1372	2224	Eternity.exe	28
PID 2224 wrote to memory of 1372	2224	Eternity.exe	28
PID 2224 wrote to memory of 1372	2224	Eternity.exe	28

C:\Users\Admin\AppData\Local\Temp\Eternity.exe
"C:\Users\Admin\AppData\Local\Temp\Eternity.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 808
  2⤵
  - Program crash
  PID:1372

memory/2224-0-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2224-1-0x0000000001390000-0x0000000003BF0000-memory.dmp

Filesize
40.4MB

Download
memory/2224-2-0x0000000007230000-0x0000000007270000-memory.dmp

Filesize
256KB

Download
memory/2224-3-0x0000000007230000-0x0000000007270000-memory.dmp

Filesize
256KB

Download
memory/2224-4-0x0000000007230000-0x0000000007270000-memory.dmp

Filesize
256KB

Download
memory/2224-5-0x0000000009890000-0x000000000AC18000-memory.dmp

Filesize
19.5MB

Download
memory/2224-6-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download