Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11/09/2024, 15:51
General
-
Target
Butterfly Rome.exe
-
Size
896KB
-
MD5
6600d3aad5ae54f1c929c73ad76b1a19
-
SHA1
e84808a2d71e084fce9406163b0008c5e5b2fa6e
-
SHA256
e2c98d04803606509f4b7f2fb612c00a8b4550cce24966988ddd29168b24b6e6
-
SHA512
52ec4266d21e246fa04a63d14fac4c5a18c0d21b5be218c8591377c718dc738cde43835b7b5169b964df976e4548d4d38f1e660702ead7458574bf3d9922044e
-
SSDEEP
12288:hEN/CKPbje87uR3Deiw+nB1qjzzHxD2r770yHLe75pfY/6tMIPTohQ17rPKM6I+B:hVUb7+s+B1qTxD2zy7Yitzt1iI+X6JY
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Butterfly Rome.exe"C:\Users\Admin\AppData\Local\Temp\Butterfly Rome.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
-
Filesize
8KB
-
Filesize
2.8MB
-
Filesize
144KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
2.8MB
-
Filesize
336KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB