Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
04-10-2021 13:33
Static task
static1
Behavioral task
behavioral1
Sample
repo.html.3.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
repo.html.3.dll
Resource
win10v20210408
General
-
Target
repo.html.3.dll
-
Size
475KB
-
MD5
267aa0f6d02c470db4951b3d9b80d8f7
-
SHA1
a9627760018699a0ce48499fd58b43e3d33c51c7
-
SHA256
da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3
-
SHA512
cf0ab54048b096bf05bc4f222473a962f2e18133e195165b582f041ee3b38536cc4e67a49dcc762c838aaeafcd164d63765ac42d58762db9f21217c12bc4eff6
Malware Config
Extracted
squirrelwaffle
profitshub.in/eJDLM6siEv
hynot-adventures.com/siRmGWRAqRR
giversherbalproducts.com/lBawcxb5
opulent-imports.com/DlOBqKAf
nitro2point0.com/9SqebpSMu
streamline-trade.com/7fTwg0V7
sologicgroup.com/hWo6FObvrdp
pedroaros.cl/gnYxifRY
apimar.eu/QFm9qbfjT
baetrading.com/IfpAV6qS
ditrpshop.in/oHbAKuM0
surveillantfire.com/s6ImD3DAJs
dhananialegalaid.com/VIVB6kFar
aulaintelimundo.com/n1n3Sh4NSO08
muwatin.net/IvyhnWs8j
nkp.hr/a9TmwEDR
kvrassociates.net/Y3kzp0WtE0
marianaleyton.com/4ByNgaVdId6
Signatures
-
SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
-
squirrelwaffle 1 IoCs
Squirrelwaffle Payload
resource yara_rule behavioral1/memory/2044-56-0x0000000010000000-0x0000000014574000-memory.dmp squirrelwaffle -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1216 wrote to memory of 2044 1216 rundll32.exe 27 PID 1216 wrote to memory of 2044 1216 rundll32.exe 27 PID 1216 wrote to memory of 2044 1216 rundll32.exe 27 PID 1216 wrote to memory of 2044 1216 rundll32.exe 27 PID 1216 wrote to memory of 2044 1216 rundll32.exe 27 PID 1216 wrote to memory of 2044 1216 rundll32.exe 27 PID 1216 wrote to memory of 2044 1216 rundll32.exe 27