squirrelwaffle | da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3

Resubmissions

14/10/2021, 12:23

211014-pkhrqsaccp10

06/10/2021, 13:07

211006-qc4vnsbdem10

06/10/2021, 07:58

211006-jtztqaagc410

Analysis

max time kernel
131s
max time network
134s
platform
windows10_x64
resource
win10v20210408
submitted
06/10/2021, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3 (1).dll
Size 475KB
Sample211006-jtztqaagc4
SHA256 da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3
MD5 267aa0f6d02c470db4951b3d9b80d8f7
SHA1 a9627760018699a0ce48499fd58b43e3d33c51c7
SHA512 cf0ab54048b096bf05bc4f222473a962f2e18133e195165b582f041ee3b38536cc4e67a49dcc762c838aaeafcd164d63765ac42d58762db9f21217c12bc4eff6
MD5 SHA1 SHA512

Score

10^/10

squirrelwaffle downloader

Malware Config

Extracted

Family

squirrelwaffle

http://profitshub.in/eJDLM6siEv
http://hynot-adventures.com/siRmGWRAqRR
http://giversherbalproducts.com/lBawcxb5
http://opulent-imports.com/DlOBqKAf
http://nitro2point0.com/9SqebpSMu
http://streamline-trade.com/7fTwg0V7
http://sologicgroup.com/hWo6FObvrdp
http://pedroaros.cl/gnYxifRY
http://apimar.eu/QFm9qbfjT
http://baetrading.com/IfpAV6qS
http://ditrpshop.in/oHbAKuM0
http://surveillantfire.com/s6ImD3DAJs
http://dhananialegalaid.com/VIVB6kFar
http://aulaintelimundo.com/n1n3Sh4NSO08
http://muwatin.net/IvyhnWs8j
http://nkp.hr/a9TmwEDR
http://kvrassociates.net/Y3kzp0WtE0
http://marianaleyton.com/4ByNgaVdId6

Signatures

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle

Squirrelwaffle Payload 1 IoCs

resource	yara_rule
behavioral2/memory/808-116-0x0000000010000000-0x0000000014574000-memory.dmp	squirrelwaffle

Blocklisted process makes network request 5 IoCs

flow	pid	Process
2	808	rundll32.exe
13	808	rundll32.exe
17	808	rundll32.exe
20	808	rundll32.exe
22	808	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 808	652	rundll32.exe	68
PID 652 wrote to memory of 808	652	rundll32.exe	68
PID 652 wrote to memory of 808	652	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3 (1).dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3 (1).dll",#1
  2⤵
  - Blocklisted process makes network request
  PID:808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-115-0x00000000043A0000-0x00000000088BD000-memory.dmp

Download

memory/808-116-0x0000000010000000-0x0000000014574000-memory.dmp