Overview

overview

10

Static

static

4aaae627ad...9e.dll

windows7_x64

10

4aaae627ad...9e.dll

windows10_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    27/09/2021, 16:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4aaae627ad4d7e56521555d5bcc8ab7b0c7d740ae480dda84ebd4dd5ff1c529e.dll
  • Size 215KB
  • Sample210927-tgnk2ahdfq
  • SHA256 4aaae627ad4d7e56521555d5bcc8ab7b0c7d740ae480dda84ebd4dd5ff1c529e
  • MD5 SHA1 SHA512
Score
10/10
squirrelwaffledownloadersuricata

Malware Config

Extracted

Family

  • squirrelwaffle

C2

  • spiritofprespa.com/9783Tci2SGF6

  • amjsys.com/RIZszf8vR

  • hrms.prodigygroupindia.com/SKyufGZV

  • centralfloridaasphalt.com/GCN0FChS

  • jhehosting.com/rUuKheB7

  • shoeclearanceoutlet.co.uk/46awDTJjI4l

  • kmslogistik.com/aS1mjTkJIy

  • bartek-lenart.pl/1bWJ57V9vx

  • voip.voipcallhub.com/ZVmfdGHs4T

  • mercyfoundationcio.org/XF9aQrXnakeG

  • key4net.com/a8A2kcc1J

  • chaturanga.groopy.com/mxN3lxZoVApc

  • voipcallhub.com/ilGht5r26

  • ems.prodigygroupindia.com/v5RvVJTz

  • novamarketing.com.pk/k8l36uus

  • lenartsa.webd.pro/fz16DjmKmHtl

  • lead.jhinfotech.co/YERjiAMaupaz

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    211.107.25.121

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

    downloadersquirrelwaffle
  • suricata: ET MALWARE Possible SQUIRRELWAFFLE Server Response

    suricata: ET MALWARE Possible SQUIRRELWAFFLE Server Response

    suricata
  • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    suricata
  • suricata: ET MALWARE SQUIRRELWAFFLE Server Response

    suricata: ET MALWARE SQUIRRELWAFFLE Server Response

    suricata
  • squirrelwaffle 2 IoCs

    Squirrelwaffle Payload

  • Blocklisted process makes network request 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4aaae627ad4d7e56521555d5bcc8ab7b0c7d740ae480dda84ebd4dd5ff1c529e.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4088
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\4aaae627ad4d7e56521555d5bcc8ab7b0c7d740ae480dda84ebd4dd5ff1c529e.dll,#1
      2⤵
      • Blocklisted process makes network request
      PID:4084

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/4084-117-0x0000000073E20000-0x0000000073E6E000-memory.dmp
        Download

        memory/4084-116-0x0000000073E20000-0x0000000073E31000-memory.dmp
        Download

        memory/4084-118-0x0000000003550000-0x0000000003551000-memory.dmp
        Download