Analysis
-
max time kernel
75s -
max time network
26s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
27-09-2021 17:42
Static task
static1
Behavioral task
behavioral1
Sample
803768a34f7e59b8a9a2f3969624c47e.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
803768a34f7e59b8a9a2f3969624c47e.dll
Resource
win10v20210408
General
-
Target
803768a34f7e59b8a9a2f3969624c47e.dll
-
Size
506KB
-
MD5
803768a34f7e59b8a9a2f3969624c47e
-
SHA1
09a38940ef023929897fdc9c996de0b0f39116e2
-
SHA256
2a0a88a2e5f9cafa10a48d63bdfcdf965b72c25978ab46cf28e795dbedc9624a
-
SHA512
21e4aa621360a4ec4a0c73fad494e133f2584f92d058a72772e390c7bf1e1ad3e4d0778e95b590c663fe5efed3cfbecb08d5e78e1216c1bfbef729062806722f
Malware Config
Extracted
squirrelwaffle
acdlimited.com/2u6aW9Pfe
jornaldasoficinas.com/ZF8GKIGVDupL
orldofjain.com/lMsTA7tSYpe
altayaralsudani.net/SSUsPgb7PHgC
hoteloaktree.com/QthLWsZsVgb
aterwellnessinc.com/U7D0sswwp
sirifinco.com/Urbhq9wO50j
ordpress17.com/5WG6Z62sKWo
mohsinkhanfoundation.com/pcQLeLMbur
lendbiz.vn/xj3BhHtMbf
geosever.rs/ObHP1CHt
nuevainfotech.com/xCNyTjzkoe
dadabhoy.pk/m6rQE94U
111
sjgrand.lk/zvMYuQqEZj
erogholding.com/GFM1QcCFk
armordetailing.rs/lgfrZb4Re6WO
lefrenchwineclub.com/eRUGdDox
Signatures
-
SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
-
squirrelwaffle 2 IoCs
Squirrelwaffle Payload
resource yara_rule behavioral1/memory/1588-57-0x00000000002C0000-0x00000000002D1000-memory.dmp squirrelwaffle behavioral1/memory/1588-58-0x0000000000410000-0x0000000000420000-memory.dmp squirrelwaffle -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 948 wrote to memory of 1588 948 rundll32.exe 27 PID 948 wrote to memory of 1588 948 rundll32.exe 27 PID 948 wrote to memory of 1588 948 rundll32.exe 27 PID 948 wrote to memory of 1588 948 rundll32.exe 27 PID 948 wrote to memory of 1588 948 rundll32.exe 27 PID 948 wrote to memory of 1588 948 rundll32.exe 27 PID 948 wrote to memory of 1588 948 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\803768a34f7e59b8a9a2f3969624c47e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\803768a34f7e59b8a9a2f3969624c47e.dll,#12⤵PID:1588
-