Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    169s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    21/01/2022, 23:07

General

  • Target

    d219628d344f9bf813c09a5d5195d750537252b78593c7656ad1a1f25528f808.dll

  • Size

    270KB

  • MD5

    16c2698f6027d7d1aab3a0dfac9394cd

  • SHA1

    b5797441e804200f00886879d56d97929c5bad84

  • SHA256

    d219628d344f9bf813c09a5d5195d750537252b78593c7656ad1a1f25528f808

  • SHA512

    421e999512b562b65ef5a908608ee4c5acca619da11c2cdde83587ca19674e08021482e286182b49fd67819b12873289e45ac22d7ce5c6dce6c30d5fa82885af

Malware Config

Extracted

Family

squirrelwaffle

C2

http://deanandwilconstruction.com/UXEvfuIlhws

http://arimeto.lv/Nm70oAfwB

http://gitamschool.com/oZbs0Oqw7uv

http://eresourcesmoneymarket.com/JbVwdgaV6l

http://flyershipmanager.com/SGAsORYsywt

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

  • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

  • Squirrelwaffle Payload 1 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\d219628d344f9bf813c09a5d5195d750537252b78593c7656ad1a1f25528f808.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\d219628d344f9bf813c09a5d5195d750537252b78593c7656ad1a1f25528f808.dll,#1
      2⤵
      • Blocklisted process makes network request
      PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2720-118-0x00000000006F0000-0x000000000083A000-memory.dmp

    Filesize

    1.3MB

  • memory/2720-119-0x0000000010000000-0x0000000010043000-memory.dmp

    Filesize

    268KB