Analysis
-
max time kernel
30s -
max time network
38s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
28-08-2024 08:03
General
-
Target
Eternity.exe
-
Size
40.8MB
-
MD5
40f0212fa97e2fe44ee0fbffae0c96b5
-
SHA1
e11664504e7b3ab905de8069e6fb5b1159aec002
-
SHA256
32d38e1eae86466254658d5a91a8bca983706b3aec35148012cb0a50f550a74f
-
SHA512
2eeebc345f202033762cfa1e5ae4a2b2f477dad7e7019e5aff7b3aff98d0a9ee7c2223a94dfb6cc1a6fd66eb0290adee3baa1fda8d99658253c005ca11f425f5
-
SSDEEP
786432:gHvsyBy7Mu30RSVRAaAeQc98NmhJQ8mZoJRWUmx2qmE:gUyCMrUVKa/bhJQ8mZorV+
Score
10/10
Malware Config
Signatures
-
Growtopia
Growtopa is an opensource modular stealer written in C#.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eternity.exe"C:\Users\Admin\AppData\Local\Temp\Eternity.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 13682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2104 -ip 21041⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
40.6MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
19.6MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
7.7MB