growtopia | 8d9f9bd5bfebfd5ca156a898cc21240d767aea11c8943d34760b05bdff586387

Analysis

max time kernel
89s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2024 20:40

Target

956a768208ff48981465018d86d3c592.exe
Size

15KB
MD5

956a768208ff48981465018d86d3c592
SHA1

a4ec75f3ae2ab4c5880faefcd3b7c78bb906aa2f
SHA256

8d9f9bd5bfebfd5ca156a898cc21240d767aea11c8943d34760b05bdff586387
SHA512

9f69e1eeed79687e14ca674ff2dc7d82e08648e6e726ad3779fc9f0d576ba4bb4eec05803f3fe377b5e71705178aa5c191430ff56239f60499ddda88eeb33656
SSDEEP

192:IGVSJrJf+Bm72P4WOnefWRjyShQSPDSFa/rtKI89Wo7rFysFMIT:pYdh+BeSON2ShQSPDSUzth8957rFviI

Score

10^/10

growtopia stealer

Family

growtopia

https://discord.com/api/webhooks/874247640320204820/3B1X1K91RjBXiE1hDnhrKls4Ih9fE6Ge_n0uYQTa2cOY8SZ1MifX9KsVxzk4U4MVBNnJ

Attributes

payload_url
https://cdn.discordapp.com/attachments/858108963778199552/872458910047559681/savedecoder.exe

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4824	4488	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\956a768208ff48981465018d86d3c592.exe
"C:\Users\Admin\AppData\Local\Temp\956a768208ff48981465018d86d3c592.exe"
1⤵
PID:4488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1132
  2⤵
  - Program crash
  PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4488 -ip 4488
1⤵
PID:2060

memory/4488-0-0x0000000000770000-0x000000000077A000-memory.dmp

Filesize
40KB

Download
memory/4488-1-0x00000000743C0000-0x0000000074B70000-memory.dmp

Filesize
7.7MB

Download
memory/4488-2-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/4488-3-0x00000000743C0000-0x0000000074B70000-memory.dmp

Filesize
7.7MB

Download