Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 10:23
Static task
static1
Behavioral task
behavioral1
Sample
butterflyondesktop.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
butterflyondesktop.exe
Resource
win10v2004-20240508-en
General
-
Target
butterflyondesktop.exe
-
Size
2.8MB
-
MD5
1535aa21451192109b86be9bcc7c4345
-
SHA1
1af211c686c4d4bf0239ed6620358a19691cf88c
-
SHA256
4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
-
SHA512
1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da
-
SSDEEP
49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
butterflyondesktop.tmppid process 4372 butterflyondesktop.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
butterflyondesktop.exedescription pid process target process PID 632 wrote to memory of 4372 632 butterflyondesktop.exe butterflyondesktop.tmp PID 632 wrote to memory of 4372 632 butterflyondesktop.exe butterflyondesktop.tmp PID 632 wrote to memory of 4372 632 butterflyondesktop.exe butterflyondesktop.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\butterflyondesktop.exe"C:\Users\Admin\AppData\Local\Temp\butterflyondesktop.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\is-VKHJ6.tmp\butterflyondesktop.tmp"C:\Users\Admin\AppData\Local\Temp\is-VKHJ6.tmp\butterflyondesktop.tmp" /SL5="$7020A,2719719,54272,C:\Users\Admin\AppData\Local\Temp\butterflyondesktop.exe"2⤵
- Executes dropped EXE
PID:4372
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891