Analysis

  • max time kernel
    70s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    23-09-2021 11:09

General

  • Target

    test1.test.dll

  • Size

    262KB

  • MD5

    67a00220a226c6039ec0126886460925

  • SHA1

    5185af9254f69a527992abd7735837b059025192

  • SHA256

    c34c4daf99203c404268764478345e7153cd9a01dcdcece04a9f200e35dd030c

  • SHA512

    6809efe4f1922a5c805396e1e8011f1179f6232fdd4a4db583d0a61de0ca15d18c56bc52d9752e62adbede87274be5adc2ec501980523ee5aa6fcfd45e3b9278

Malware Config

Extracted

Family

squirrelwaffle

C2

deanandwilconstruction.com/UXEvfuIlhws

arimeto.lv/Nm70oAfwB

gitamschool.com/oZbs0Oqw7uv

eresourcesmoneymarket.com/JbVwdgaV6l

flyershipmanager.com/SGAsORYsywt

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

  • squirrelwaffle 1 IoCs

    Squirrelwaffle Payload

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\test1.test.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\test1.test.dll,#1
      2⤵
        PID:1236

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1236-54-0x0000000076851000-0x0000000076853000-memory.dmp

      Filesize

      8KB

    • memory/1236-55-0x0000000000170000-0x000000000018E000-memory.dmp

      Filesize

      120KB

    • memory/1236-56-0x0000000010000000-0x0000000010044000-memory.dmp

      Filesize

      272KB