Analysis
-
max time kernel
150s -
max time network
39s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-09-2021 20:37
Static task
static1
Behavioral task
behavioral1
Sample
test1.test.dll
Resource
win7v20210408
Behavioral task
behavioral2
Sample
test1.test.dll
Resource
win10-en-20210920
General
-
Target
test1.test.dll
-
Size
302KB
-
MD5
0a359f52ad35a8d335019332274d3c88
-
SHA1
3a2c847631d1d3592762c5c9abd7367e4d15cd1b
-
SHA256
de7efe687330b83242dbd1dc00b380933b238b490ba6ba2617330bdf54d1a9ea
-
SHA512
f9502c7ef0d25357b6ed3a62f834b10b695c03c99ccabff6cf40d0fb15eeed1a696ce3025f9d2af08e85a3446562ee2c96bdacbeae4015ef0a2ed2faaf6f4d13
Malware Config
Extracted
squirrelwaffle
atertreat.in/5iPPVRKPPX9
incentivaconsultores.com.co/55jHpKCc9DWy
cdelean.org/0qvbbmu9g
bazy.ps/M6SjrMSYC
sukmabali.com/ZXxcLYs3rzRQ
bugwilliam.tk/cbB56YrugdbW
bestbeatsgh.com/42D7OwuPen
krumaila.com/UZ4NdDoDh4Tu
razehub.com/NN70nExbtLO
arcb.ro/aHUUNxE3Me5
cfmi.tg/m40YS6gDO0
sweetlittle.mx/ZCXP0dT2h
alkimia-prod.com/nT0imyzmo
almexperts.co.za/fEoJ3pdWZbF
Signatures
-
SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
-
squirrelwaffle 1 IoCs
Squirrelwaffle Payload
resource yara_rule behavioral1/memory/1036-63-0x0000000010000000-0x000000001004D000-memory.dmp squirrelwaffle -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1080 wrote to memory of 1036 1080 rundll32.exe 25 PID 1080 wrote to memory of 1036 1080 rundll32.exe 25 PID 1080 wrote to memory of 1036 1080 rundll32.exe 25 PID 1080 wrote to memory of 1036 1080 rundll32.exe 25 PID 1080 wrote to memory of 1036 1080 rundll32.exe 25 PID 1080 wrote to memory of 1036 1080 rundll32.exe 25 PID 1080 wrote to memory of 1036 1080 rundll32.exe 25