Overview

overview

7

Static

static

3

GrowtopiaI...2).exe

windows7-x64

6

GrowtopiaI...2).exe

windows10-2004-x64

4

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Growtopia.exe

windows7-x64

1

Growtopia.exe

windows10-2004-x64

1

SecureEngineSDK64.dll

windows7-x64

1

SecureEngineSDK64.dll

windows10-2004-x64

1

ubiservices.dll

windows7-x64

1

ubiservices.dll

windows10-2004-x64

1

vc_redist.x64.exe

windows7-x64

7

vc_redist.x64.exe

windows10-2004-x64

7

vc_redist.x86.exe

windows7-x64

7

vc_redist.x86.exe

windows10-2004-x64

7

zlibwapi.dll

windows7-x64

1

zlibwapi.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    GrowtopiaInstaller (2).exe
  • Size 191.8MB
  • Sample240222-tyjneacg86
  • SHA256 180b585699602924e45e46c6ba98ce91964d37f8e10e9859ec14542ecb45762a
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discovery

Malware Config

Targets

    • Target
      GrowtopiaInstaller (2).exe
    • Size 191.8MB
    • SHA256 180b585699602924e45e46c6ba98ce91964d37f8e10e9859ec14542ecb45762a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 14KB
    • SHA256 fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral5behavioral6
    • Target
      Growtopia.exe
    • Size 19.6MB
    • SHA256 a5b11c9c85abc21c691454756ba99880b5efc29c8e9278fee417236fe2a392d0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7behavioral8
    • Target
      SecureEngineSDK64.dll
    • Size 28KB
    • SHA256 9387fedbd201f2886a28f32d1ec155a69ac86ea78e331381f6db521f8b4b5a11
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10behavioral9
    • Target
      ubiservices.dll
    • Size 14.8MB
    • SHA256 068bc38fa95a55d74470e9df9da71b8106668aaa647619d83a036808f14e6e5b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      vc_redist.x64.exe
    • Size 13.9MB
    • SHA256 5eea714e1f22f1875c1cb7b1738b0c0b1f02aec5ecb95f0fdb1c5171c6cd93a3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral13behavioral14
    • Target
      vc_redist.x86.exe
    • Size 13.1MB
    • SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral15behavioral16
    • Target
      zlibwapi.dll
    • Size 87KB
    • SHA256 1f047faec08d9a35c304fb4a7cf13853589359a8f7cbfdd48c5d5807712dcf05
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks