Analysis
-
max time kernel
133s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
16-03-2024 11:54
General
-
Target
cdff58dd01e04e8717c84790a704048e.exe
-
Size
28.0MB
-
MD5
cdff58dd01e04e8717c84790a704048e
-
SHA1
e3982a7a9c68bc3c1b065c6c285944b9870b8f0d
-
SHA256
68698ea23df40912c2a58b909e440f235b30a11a638c3489c54b0e7499ce9f05
-
SHA512
b2165a389e40dcb613dcc447d58cbe1c4c24f0db7d9824dea2b48feda006d10b65a9f4a9c3b289d6af641453bc91e2dfd8b048e277245d48c2827eb4677427ad
-
SSDEEP
786432:7pPP4FMWcNEqcYQkvvprmHgfMjqUe7bgjUME:dPP4ejNN7pnpruuMjqPbgE
Score
10/10
Malware Config
Signatures
-
Growtopia
Growtopa is an opensource modular stealer written in C#.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdff58dd01e04e8717c84790a704048e.exe"C:\Users\Admin\AppData\Local\Temp\cdff58dd01e04e8717c84790a704048e.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 13242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2960 -ip 29601⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
57.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
14.5MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB