squirrelwaffle | 278f92d704ed714c94aa4ccf397552d57e04455565cf18139ac46e6f3b30177d

Analysis

max time kernel
148s
max time network
151s
platform
windows10_x64
resource
win10-en-20210920
submitted
27-09-2021 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1515633aa74826ddde0648e7829ea880.dll
Size

256KB
MD5

1515633aa74826ddde0648e7829ea880
SHA1

9d91401903a35835349521bbf578039aef934eea
SHA256

278f92d704ed714c94aa4ccf397552d57e04455565cf18139ac46e6f3b30177d
SHA512

01850b38667645c3e51635aafe4ef43895e485d6885b74ae4f7ac5f910cdcd231407279b4667162bcc4f203090f54074dba4c11c9b96672a6f7c4b2f7962b110

Score

10^/10

squirrelwaffle downloader suricata

Malware Config

Extracted

Family

squirrelwaffle

acdlimited.com/2u6aW9Pfe

jornaldasoficinas.com/ZF8GKIGVDupL

orldofjain.com/lMsTA7tSYpe

altayaralsudani.net/SSUsPgb7PHgC

hoteloaktree.com/QthLWsZsVgb

aterwellnessinc.com/U7D0sswwp

sirifinco.com/Urbhq9wO50j

ordpress17.com/5WG6Z62sKWo

mohsinkhanfoundation.com/pcQLeLMbur

lendbiz.vn/xj3BhHtMbf

geosever.rs/ObHP1CHt

nuevainfotech.com/xCNyTjzkoe

dadabhoy.pk/m6rQE94U

111

sjgrand.lk/zvMYuQqEZj

erogholding.com/GFM1QcCFk

armordetailing.rs/lgfrZb4Re6WO

lefrenchwineclub.com/eRUGdDox

Signatures

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle
suricata: ET MALWARE Possible SQUIRRELWAFFLE Server Response
suricata: ET MALWARE Possible SQUIRRELWAFFLE Server Response
suricata
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
suricata
suricata: ET MALWARE SQUIRRELWAFFLE Server Response
suricata: ET MALWARE SQUIRRELWAFFLE Server Response
suricata

squirrelwaffle 2 IoCs

Squirrelwaffle Payload

resource	yara_rule
behavioral2/memory/2620-116-0x0000000010000000-0x0000000010010000-memory.dmp	squirrelwaffle
behavioral2/memory/2620-117-0x0000000010000000-0x00000000100D6000-memory.dmp	squirrelwaffle

Blocklisted process makes network request 4 IoCs

flow	pid	Process
6	2620	rundll32.exe
9	2620	rundll32.exe
12	2620	rundll32.exe
13	2620	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2620	2428	rundll32.exe	70
PID 2428 wrote to memory of 2620	2428	rundll32.exe	70
PID 2428 wrote to memory of 2620	2428	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1515633aa74826ddde0648e7829ea880.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1515633aa74826ddde0648e7829ea880.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2620-116-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2620-117-0x0000000010000000-0x00000000100D6000-memory.dmp

Filesize
856KB

Download
memory/2620-118-0x0000000000D10000-0x0000000000E5A000-memory.dmp

Filesize
1.3MB

Download