Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
7Butterfly Rome.exe
windows7-x64
10Butterfly Rome.exe
windows10-2004-x64
10Data/Rome_Run.dll
windows7-x64
3Data/Rome_Run.dll
windows10-2004-x64
3Data/Rome_Win.dll
windows7-x64
3Data/Rome_Win.dll
windows10-2004-x64
3Rome_App.dll
windows7-x64
10Rome_App.dll
windows10-2004-x64
10Sbot/Data.dll
windows7-x64
1Sbot/Data.dll
windows10-2004-x64
1Sbot/OgreMain.dll
windows7-x64
3Sbot/OgreMain.dll
windows10-2004-x64
3Sbot/RomeBotbin.exe
windows7-x64
6Sbot/RomeBotbin.exe
windows10-2004-x64
6Sbot/RomeBotdat.exe
windows7-x64
6Sbot/RomeBotdat.exe
windows10-2004-x64
3Sbot/libeay32.dll
windows7-x64
3Sbot/libeay32.dll
windows10-2004-x64
3Sbot/msvcp90.dll
windows7-x64
3Sbot/msvcp90.dll
windows10-2004-x64
3Sbot/msvcr90.dll
windows7-x64
3Sbot/msvcr90.dll
windows10-2004-x64
3Sbot/svrbase.dll
windows7-x64
3Sbot/svrbase.dll
windows10-2004-x64
3Sbot/svrcom.dll
windows7-x64
3Sbot/svrcom.dll
windows10-2004-x64
3Sbot/svrfun.dll
windows7-x64
3Sbot/svrfun.dll
windows10-2004-x64
3Updater.exe
windows7-x64
3Updater.exe
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 15:51
Behavioral task
behavioral1
Sample
Butterfly Rome.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Butterfly Rome.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Data/Rome_Run.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Data/Rome_Run.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Data/Rome_Win.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Data/Rome_Win.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Rome_App.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Rome_App.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Sbot/Data.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Sbot/Data.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Sbot/OgreMain.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Sbot/OgreMain.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Sbot/RomeBotbin.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Sbot/RomeBotbin.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Sbot/RomeBotdat.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
Sbot/RomeBotdat.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Sbot/libeay32.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Sbot/libeay32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Sbot/msvcp90.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Sbot/msvcp90.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Sbot/msvcr90.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
Sbot/msvcr90.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Sbot/svrbase.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Sbot/svrbase.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Sbot/svrcom.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
Sbot/svrcom.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Sbot/svrfun.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Sbot/svrfun.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Updater.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Updater.exe
Resource
win10v2004-20240802-en
General
-
Target
Butterfly Rome.exe
-
Size
896KB
-
MD5
6600d3aad5ae54f1c929c73ad76b1a19
-
SHA1
e84808a2d71e084fce9406163b0008c5e5b2fa6e
-
SHA256
e2c98d04803606509f4b7f2fb612c00a8b4550cce24966988ddd29168b24b6e6
-
SHA512
52ec4266d21e246fa04a63d14fac4c5a18c0d21b5be218c8591377c718dc738cde43835b7b5169b964df976e4548d4d38f1e660702ead7458574bf3d9922044e
-
SSDEEP
12288:hEN/CKPbje87uR3Deiw+nB1qjzzHxD2r770yHLe75pfY/6tMIPTohQ17rPKM6I+B:hVUb7+s+B1qTxD2zy7Yitzt1iI+X6JY
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral1/memory/2360-10-0x0000000010000000-0x0000000010054000-memory.dmp family_blackmoon behavioral1/memory/2360-14-0x0000000010000000-0x0000000010054000-memory.dmp family_blackmoon -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2360 Butterfly Rome.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Butterfly Rome.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2360 Butterfly Rome.exe 2360 Butterfly Rome.exe