Overview
overview
10Static
static
10Malware-da...00.exe
windows11-21h2-x64
Malware-da...ws.exe
windows11-21h2-x64
6Malware-da...as.exe
windows11-21h2-x64
1Malware-da...ck.exe
windows11-21h2-x64
1Malware-da...V2.exe
windows11-21h2-x64
10Malware-da...er.exe
windows11-21h2-x64
1Malware-da...an.exe
windows11-21h2-x64
1Malware-da...up.exe
windows11-21h2-x64
1Malware-da...nt.exe
windows11-21h2-x64
Malware-da...ye.exe
windows11-21h2-x64
Malware-da...ry.exe
windows11-21h2-x64
10Malware-da...op.exe
windows11-21h2-x64
7Resubmissions
27-05-2024 22:11
240527-14ae9ada43 1027-05-2024 21:15
240527-z3zhbabd59 1013-02-2024 12:11
240213-pcwzdshd2w 1013-02-2024 12:08
240213-pa6qtahc7y 1018-12-2023 08:13
231218-j4g2nabaf5 1005-12-2023 08:54
231205-kt32taae27 1005-12-2023 07:41
231205-jjdthahh6w 1005-12-2023 07:38
231205-jgmcvshh5x 1026-11-2023 09:39
231126-lmxf5agd87 10Analysis
-
max time kernel
1792s -
max time network
1652s -
platform
windows11-21h2_x64 -
resource
win11-20231129-en -
resource tags
arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-12-2023 08:54
Behavioral task
behavioral1
Sample
Malware-database-main/000.exe
Resource
win11-20231129-en
Behavioral task
behavioral2
Sample
Malware-database-main/ChilledWindows.exe
Resource
win11-20231129-en
Behavioral task
behavioral3
Sample
Malware-database-main/Christmas.exe
Resource
win11-20231129-en
Behavioral task
behavioral4
Sample
Malware-database-main/CookieClickerHack.exe
Resource
win11-20231129-en
Behavioral task
behavioral5
Sample
Malware-database-main/Electron V2.exe
Resource
win11-20231129-en
Behavioral task
behavioral6
Sample
Malware-database-main/Flasher.exe
Resource
win11-20231129-en
Behavioral task
behavioral7
Sample
Malware-database-main/MEMZ Trojan.exe
Resource
win11-20231129-en
Behavioral task
behavioral8
Sample
Malware-database-main/Popup.exe
Resource
win11-20231128-en
Behavioral task
behavioral9
Sample
Malware-database-main/PowerPoint.exe
Resource
win11-20231128-en
Behavioral task
behavioral10
Sample
Malware-database-main/RedEye.exe
Resource
win11-20231128-en
Behavioral task
behavioral11
Sample
Malware-database-main/WannaCry.exe
Resource
win11-20231128-en
Behavioral task
behavioral12
Sample
Malware-database-main/butterflyondesktop.exe
Resource
win11-20231129-en
General
-
Target
Malware-database-main/butterflyondesktop.exe
-
Size
2.8MB
-
MD5
1535aa21451192109b86be9bcc7c4345
-
SHA1
1af211c686c4d4bf0239ed6620358a19691cf88c
-
SHA256
4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
-
SHA512
1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da
-
SSDEEP
49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
butterflyondesktop.tmppid process 4756 butterflyondesktop.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
butterflyondesktop.exedescription pid process target process PID 3756 wrote to memory of 4756 3756 butterflyondesktop.exe butterflyondesktop.tmp PID 3756 wrote to memory of 4756 3756 butterflyondesktop.exe butterflyondesktop.tmp PID 3756 wrote to memory of 4756 3756 butterflyondesktop.exe butterflyondesktop.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-J9KT2.tmp\butterflyondesktop.tmp"C:\Users\Admin\AppData\Local\Temp\is-J9KT2.tmp\butterflyondesktop.tmp" /SL5="$50204,2719719,54272,C:\Users\Admin\AppData\Local\Temp\Malware-database-main\butterflyondesktop.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-J9KT2.tmp\butterflyondesktop.tmpFilesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
-
C:\Users\Admin\AppData\Local\Temp\is-J9KT2.tmp\butterflyondesktop.tmpFilesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
-
memory/3756-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3756-2-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3756-13-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4756-7-0x0000000002440000-0x0000000002441000-memory.dmpFilesize
4KB
-
memory/4756-14-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/4756-17-0x0000000002440000-0x0000000002441000-memory.dmpFilesize
4KB