squirrelwaffle | 278f92d704ed714c94aa4ccf397552d57e04455565cf18139ac46e6f3b30177d

Analysis

max time kernel
68s
max time network
42s
platform
windows7_x64
resource
win7-en-20210920
submitted
27-09-2021 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1515633aa74826ddde0648e7829ea880.dll
Size

256KB
MD5

1515633aa74826ddde0648e7829ea880
SHA1

9d91401903a35835349521bbf578039aef934eea
SHA256

278f92d704ed714c94aa4ccf397552d57e04455565cf18139ac46e6f3b30177d
SHA512

01850b38667645c3e51635aafe4ef43895e485d6885b74ae4f7ac5f910cdcd231407279b4667162bcc4f203090f54074dba4c11c9b96672a6f7c4b2f7962b110

Score

10^/10

squirrelwaffle downloader

Malware Config

Extracted

Family

squirrelwaffle

acdlimited.com/2u6aW9Pfe

jornaldasoficinas.com/ZF8GKIGVDupL

orldofjain.com/lMsTA7tSYpe

altayaralsudani.net/SSUsPgb7PHgC

hoteloaktree.com/QthLWsZsVgb

aterwellnessinc.com/U7D0sswwp

sirifinco.com/Urbhq9wO50j

ordpress17.com/5WG6Z62sKWo

mohsinkhanfoundation.com/pcQLeLMbur

lendbiz.vn/xj3BhHtMbf

geosever.rs/ObHP1CHt

nuevainfotech.com/xCNyTjzkoe

dadabhoy.pk/m6rQE94U

111

sjgrand.lk/zvMYuQqEZj

erogholding.com/GFM1QcCFk

armordetailing.rs/lgfrZb4Re6WO

lefrenchwineclub.com/eRUGdDox

Signatures

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle

squirrelwaffle 2 IoCs

Squirrelwaffle Payload

resource	yara_rule
behavioral1/memory/1236-56-0x0000000010000000-0x00000000100D6000-memory.dmp	squirrelwaffle
behavioral1/memory/1236-55-0x0000000010000000-0x0000000010010000-memory.dmp	squirrelwaffle

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1515633aa74826ddde0648e7829ea880.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1515633aa74826ddde0648e7829ea880.dll,#1
  2⤵
  PID:1236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-54-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/1236-56-0x0000000010000000-0x00000000100D6000-memory.dmp

Filesize
856KB

Download
memory/1236-55-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1236-57-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download