Analysis
-
max time kernel
1782s -
max time network
1784s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-09-2021 13:35
Static task
static1
Behavioral task
behavioral1
Sample
test1.test.dll
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral2
Sample
test1.test.dll
Resource
win10v20210408
windows10_x64
General
-
Target
test1.test.dll
-
Size
235KB
-
MD5
8e37795097400f6a609525749d154cd0
-
SHA1
8e1502c2aa56e6a8c7c1d2c75f3946332a5bb8c0
-
SHA256
6402b33d729c8bb44881747a8f397f4aec408bf5e18b9af6fd86cdfa3f96323b
-
SHA512
c7453b8f50e557a5990ac3708931845eeb6dc2992cd907d5534733524f523226d8d013be6e09bb2b5210f6f5ad2303625f8998a5111d3b0925bb4228b6c9152a
Malware Config
Extracted
squirrelwaffle
acdlimited.com/2u6aW9Pfe
jornaldasoficinas.com/ZF8GKIGVDupL
orldofjain.com/lMsTA7tSYpe
altayaralsudani.net/SSUsPgb7PHgC
hoteloaktree.com/QthLWsZsVgb
aterwellnessinc.com/U7D0sswwp
sirifinco.com/Urbhq9wO50j
ordpress17.com/5WG6Z62sKWo
mohsinkhanfoundation.com/pcQLeLMbur
lendbiz.vn/xj3BhHtMbf
geosever.rs/ObHP1CHt
nuevainfotech.com/xCNyTjzkoe
dadabhoy.pk/m6rQE94U
111
sjgrand.lk/zvMYuQqEZj
erogholding.com/GFM1QcCFk
armordetailing.rs/lgfrZb4Re6WO
lefrenchwineclub.com/eRUGdDox
Signatures
-
SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
-
suricata: ET MALWARE Possible SQUIRRELWAFFLE Server Response
suricata: ET MALWARE Possible SQUIRRELWAFFLE Server Response
-
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
-
suricata: ET MALWARE SQUIRRELWAFFLE Server Response
suricata: ET MALWARE SQUIRRELWAFFLE Server Response
-
squirrelwaffle 2 IoCs
Squirrelwaffle Payload
resource yara_rule behavioral2/memory/4032-116-0x0000000010000000-0x00000000100D6000-memory.dmp squirrelwaffle behavioral2/memory/4032-115-0x0000000010000000-0x0000000010010000-memory.dmp squirrelwaffle -
Blocklisted process makes network request 64 IoCs
flow pid Process 11 4032 rundll32.exe 14 4032 rundll32.exe 15 4032 rundll32.exe 16 4032 rundll32.exe 17 4032 rundll32.exe 18 4032 rundll32.exe 19 4032 rundll32.exe 20 4032 rundll32.exe 21 4032 rundll32.exe 28 4032 rundll32.exe 29 4032 rundll32.exe 33 4032 rundll32.exe 34 4032 rundll32.exe 35 4032 rundll32.exe 36 4032 rundll32.exe 37 4032 rundll32.exe 38 4032 rundll32.exe 39 4032 rundll32.exe 40 4032 rundll32.exe 41 4032 rundll32.exe 42 4032 rundll32.exe 43 4032 rundll32.exe 44 4032 rundll32.exe 45 4032 rundll32.exe 46 4032 rundll32.exe 47 4032 rundll32.exe 48 4032 rundll32.exe 49 4032 rundll32.exe 50 4032 rundll32.exe 51 4032 rundll32.exe 52 4032 rundll32.exe 53 4032 rundll32.exe 54 4032 rundll32.exe 55 4032 rundll32.exe 56 4032 rundll32.exe 57 4032 rundll32.exe 59 4032 rundll32.exe 60 4032 rundll32.exe 61 4032 rundll32.exe 62 4032 rundll32.exe 63 4032 rundll32.exe 64 4032 rundll32.exe 65 4032 rundll32.exe 66 4032 rundll32.exe 67 4032 rundll32.exe 68 4032 rundll32.exe 69 4032 rundll32.exe 70 4032 rundll32.exe 71 4032 rundll32.exe 72 4032 rundll32.exe 73 4032 rundll32.exe 74 4032 rundll32.exe 75 4032 rundll32.exe 76 4032 rundll32.exe 77 4032 rundll32.exe 78 4032 rundll32.exe 79 4032 rundll32.exe 80 4032 rundll32.exe 82 4032 rundll32.exe 83 4032 rundll32.exe 84 4032 rundll32.exe 85 4032 rundll32.exe 86 4032 rundll32.exe 87 4032 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3628 wrote to memory of 4032 3628 rundll32.exe 68 PID 3628 wrote to memory of 4032 3628 rundll32.exe 68 PID 3628 wrote to memory of 4032 3628 rundll32.exe 68