Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30/01/2022, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
277c5272ac242f4f737cae075fe33b5793364090c55d9cf743e61e52a453daf6.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
277c5272ac242f4f737cae075fe33b5793364090c55d9cf743e61e52a453daf6.dll
Resource
win10-en-20211208
General
-
Target
277c5272ac242f4f737cae075fe33b5793364090c55d9cf743e61e52a453daf6.dll
-
Size
333KB
-
MD5
ca91c16904dcf84520cd41417285f0bc
-
SHA1
f261b0943ce84cd4ead5fdc73694bc2f6113c4f1
-
SHA256
277c5272ac242f4f737cae075fe33b5793364090c55d9cf743e61e52a453daf6
-
SHA512
c22c9bf6dadf6671465441a26ba1a0fe7d8d68bd6ab49087d10262e9c773cbe3baa2aa1bc328c3e990ea6f5e4b27f5b9411ed319fa28e76bdd89d3eea76f3c3a
Malware Config
Extracted
squirrelwaffle
http://atertreat.in/5iPPVRKPPX9
http://incentivaconsultores.com.co/55jHpKCc9DWy
http://cdelean.org/0qvbbmu9g
http://bazy.ps/M6SjrMSYC
http://sukmabali.com/ZXxcLYs3rzRQ
http://bugwilliam.tk/cbB56YrugdbW
http://bestbeatsgh.com/42D7OwuPen
http://krumaila.com/UZ4NdDoDh4Tu
http://razehub.com/NN70nExbtLO
http://arcb.ro/aHUUNxE3Me5
http://cfmi.tg/m40YS6gDO0
http://sweetlittle.mx/ZCXP0dT2h
http://alkimia-prod.com/nT0imyzmo
http://almexperts.co.za/fEoJ3pdWZbF
Signatures
-
SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
-
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
-
Squirrelwaffle Payload 1 IoCs
resource yara_rule behavioral2/memory/2800-116-0x0000000010000000-0x000000001004D000-memory.dmp squirrelwaffle -
Blocklisted process makes network request 5 IoCs
flow pid Process 17 2800 rundll32.exe 24 2800 rundll32.exe 33 2800 rundll32.exe 38 2800 rundll32.exe 40 2800 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2800 2740 rundll32.exe 68 PID 2740 wrote to memory of 2800 2740 rundll32.exe 68 PID 2740 wrote to memory of 2800 2740 rundll32.exe 68
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\277c5272ac242f4f737cae075fe33b5793364090c55d9cf743e61e52a453daf6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\277c5272ac242f4f737cae075fe33b5793364090c55d9cf743e61e52a453daf6.dll,#12⤵
- Blocklisted process makes network request
PID:2800
-