squirrelwaffle | 4545b601c6d8a636dce6597da6443dce45d11b48fcf668336bcdf12ffdc3e97e

Analysis

max time kernel
130s
max time network
138s
platform
windows10_x64
resource
win10-en-20210920
submitted
23-09-2021 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.test.dll
Size

222KB
MD5

539e0a32348f112da72bb7868fd5cfac
SHA1

bcdfd82522a0a45af4e4064c7f509b29b8ea83ed
SHA256

4545b601c6d8a636dce6597da6443dce45d11b48fcf668336bcdf12ffdc3e97e
SHA512

d3b46706f1724bf9e4daf53461ebdcef607354b2d30608e9fe2cf33aa282eac7143071ac1e8712679f15bf72abf7454562f4179a90f5a6d61af5658cb3fe762d

Score

10^/10

squirrelwaffle downloader suricata

Malware Config

Extracted

Family

squirrelwaffle

pop.vicamtaynam.com/VtyiHAft

snsvidyapeeth.in/aXmo2Dr3

trinitytesttubebaby.com/QR2JvfE3Sv

iconskw.com/cqdPtAbZ

ebookchuyennganh.com/v9PMvQDxHK8W

alsader.net/BHdQaiQ9rt

avyanshglobal.com/6pYjPlqf

primahills-online.com/ypCiZn7tMx

antoniocastroycia.com.co/WHe08obY

apexbiotech.net/VQgunQ4t5Ue

vscm.in/V3tYKxDz

sinaloworx.co.za/3GilA8Eo3r

dancongnghe.xyz/yRByhX6J3REI

trajesuniformes.com.br/qQofZMaJm

fiorenzapaes.com.br/PGYpETW7

astetinternational.com/arW5e44Y7vzO

razisystem.ir/MqvvkX0cWvn

krishnaiti.org.in/rWA02HQY4

Signatures

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle
suricata: ET MALWARE Possible SQUIRRELWAFFLE Server Response
suricata: ET MALWARE Possible SQUIRRELWAFFLE Server Response
suricata
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
suricata
suricata: ET MALWARE SQUIRRELWAFFLE Server Response
suricata: ET MALWARE SQUIRRELWAFFLE Server Response
suricata

squirrelwaffle 1 IoCs

Squirrelwaffle Payload

resource	yara_rule
behavioral2/memory/3604-117-0x0000000010000000-0x0000000014030000-memory.dmp	squirrelwaffle

Blocklisted process makes network request 5 IoCs

flow	pid	Process
3	3604	rundll32.exe
5	3604	rundll32.exe
6	3604	rundll32.exe
7	3604	rundll32.exe
10	3604	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3604	3716	rundll32.exe	70
PID 3716 wrote to memory of 3604	3716	rundll32.exe	70
PID 3716 wrote to memory of 3604	3716	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:3604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3604-116-0x00000000045A0000-0x00000000085BA000-memory.dmp

Filesize
64.1MB

Download
memory/3604-117-0x0000000010000000-0x0000000014030000-memory.dmp

Filesize
64.2MB

Download