Resubmissions

23/07/2024, 17:32

240723-v4egba1drj 10

Analysis

  • max time kernel
    143s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 17:32

General

  • Target

    ButterflyLauncher.exe

  • Size

    241.1MB

  • MD5

    b29564dd9adcdac584e65fcb27dc3f13

  • SHA1

    be24c69c4e12eb2beb9ac5d431bb60f520a179a0

  • SHA256

    2c552d11daebd76dafe245681272cc13fd9c51b01f9c475d609f9aeccafe3fe5

  • SHA512

    846265617a267f587ac55ebdf855ebd2c22706b89b734597aa1466a6e10866662ed3ec89c9c4a0a0f1e9aa489fa4ed7fe3bfb1e51a83cabcb736b24309c19e1f

  • SSDEEP

    1572864:8hhHI0W4V8PW6Z/wbmrKy7YgIkW433h28PW6Z/wbmrCy7YgIl4LpgF3TVGnBJm9I:qho0+fZaM2kHR3fZaU2l/F3Vn0f

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ButterflyLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\ButterflyLauncher.exe"
    1⤵
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:3640

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3640-0-0x0000000180000000-0x0000000180A25000-memory.dmp

    Filesize

    10.1MB

  • memory/3640-3-0x00007FF6AD98E000-0x00007FF6AD98F000-memory.dmp

    Filesize

    4KB

  • memory/3640-4-0x0000019B80080000-0x0000019B80093000-memory.dmp

    Filesize

    76KB

  • memory/3640-13-0x0000019BA69A0000-0x0000019BA6A61000-memory.dmp

    Filesize

    772KB

  • memory/3640-23-0x0000019B80240000-0x0000019B80258000-memory.dmp

    Filesize

    96KB

  • memory/3640-19-0x0000019B80060000-0x0000019B80080000-memory.dmp

    Filesize

    128KB

  • memory/3640-16-0x0000019B801E0000-0x0000019B801ED000-memory.dmp

    Filesize

    52KB

  • memory/3640-28-0x0000019BA68F0000-0x0000019BA6911000-memory.dmp

    Filesize

    132KB

  • memory/3640-52-0x0000019B801F0000-0x0000019B801F7000-memory.dmp

    Filesize

    28KB

  • memory/3640-55-0x0000019BA68E0000-0x0000019BA68EA000-memory.dmp

    Filesize

    40KB

  • memory/3640-49-0x0000019BA6B40000-0x0000019BA6B7E000-memory.dmp

    Filesize

    248KB

  • memory/3640-46-0x0000019BA6B00000-0x0000019BA6B34000-memory.dmp

    Filesize

    208KB

  • memory/3640-43-0x0000019BA6CC0000-0x0000019BA6D75000-memory.dmp

    Filesize

    724KB

  • memory/3640-40-0x0000019BA6950000-0x0000019BA697D000-memory.dmp

    Filesize

    180KB

  • memory/3640-37-0x0000019BA68C0000-0x0000019BA68D3000-memory.dmp

    Filesize

    76KB

  • memory/3640-34-0x0000019BA6BC0000-0x0000019BA6CBE000-memory.dmp

    Filesize

    1016KB

  • memory/3640-31-0x0000019BA6A70000-0x0000019BA6AB0000-memory.dmp

    Filesize

    256KB

  • memory/3640-9-0x0000019BA7580000-0x0000019BA8231000-memory.dmp

    Filesize

    12.7MB

  • memory/3640-10-0x0000019B801C0000-0x0000019B801D2000-memory.dmp

    Filesize

    72KB

  • memory/3640-58-0x0000019BA6E90000-0x0000019BA6EA6000-memory.dmp

    Filesize

    88KB

  • memory/3640-61-0x0000019BA6EB0000-0x0000019BA6EDA000-memory.dmp

    Filesize

    168KB

  • memory/3640-64-0x0000019BA7350000-0x0000019BA7366000-memory.dmp

    Filesize

    88KB

  • memory/3640-67-0x0000019BA7330000-0x0000019BA7335000-memory.dmp

    Filesize

    20KB

  • memory/3640-263-0x00007FF6AD98E000-0x00007FF6AD98F000-memory.dmp

    Filesize

    4KB