Overview
overview
10Static
static
061dfb6a25...52.dll
windows7_x64
10061dfb6a25...52.dll
windows10_x64
1006d55f75d7...d2.dll
windows7_x64
1006d55f75d7...d2.dll
windows10_x64
1024401ac43b...65.dll
windows7_x64
124401ac43b...65.dll
windows10_x64
1260e2d5769...40.dll
windows7_x64
10260e2d5769...40.dll
windows10_x64
1026cd036960...18.dll
windows7_x64
1026cd036960...18.dll
windows10_x64
102a0a88a2e5...4a.dll
windows7_x64
102a0a88a2e5...4a.dll
windows10_x64
32f33217d51...94.dll
windows7_x64
102f33217d51...94.dll
windows10_x64
10336cdd146b...da.dll
windows7_x64
10336cdd146b...da.dll
windows10_x64
10417c1828d9...73.dll
windows7_x64
10417c1828d9...73.dll
windows10_x64
104d3095c796...ee.dll
windows7_x64
104d3095c796...ee.dll
windows10_x64
1054e526fe05...4c.dll
windows7_x64
154e526fe05...4c.dll
windows10_x64
16402b33d72...3b.dll
windows7_x64
106402b33d72...3b.dll
windows10_x64
1064c044cb3e...db.dll
windows7_x64
1064c044cb3e...db.dll
windows10_x64
10671f477c30...4e.dll
windows7_x64
10671f477c30...4e.dll
windows10_x64
1067785724b6...ce.dll
windows7_x64
167785724b6...ce.dll
windows10_x64
36c6934613a...fb.dll
windows7_x64
106c6934613a...fb.dll
windows10_x64
10Resubmissions
01-11-2021 12:31
211101-pp5r3ahha4 1031-10-2021 09:03
211031-k1bwxacfaq 1014-10-2021 01:44
211014-b6aflafeg4 10Analysis
-
max time kernel
140s -
max time network
135s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 01:44
Static task
static1
Behavioral task
behavioral1
Sample
061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll
Resource
win10v20210408
Behavioral task
behavioral3
Sample
06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll
Resource
win7-en-20210920
Behavioral task
behavioral4
Sample
06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll
Resource
win10v20210408
Behavioral task
behavioral5
Sample
24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365.dll
Resource
win7-en-20210920
Behavioral task
behavioral6
Sample
24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365.dll
Resource
win10v20210408
Behavioral task
behavioral7
Sample
260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll
Resource
win7-en-20210920
Behavioral task
behavioral8
Sample
260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll
Resource
win10-en-20210920
Behavioral task
behavioral9
Sample
26cd03696045fb93b415b022fa6bc832098394bf362f4b4c4e897e9550d12618.dll
Resource
win7v20210408
Behavioral task
behavioral10
Sample
26cd03696045fb93b415b022fa6bc832098394bf362f4b4c4e897e9550d12618.dll
Resource
win10-en-20210920
Behavioral task
behavioral11
Sample
2a0a88a2e5f9cafa10a48d63bdfcdf965b72c25978ab46cf28e795dbedc9624a.dll
Resource
win7v20210408
Behavioral task
behavioral12
Sample
2a0a88a2e5f9cafa10a48d63bdfcdf965b72c25978ab46cf28e795dbedc9624a.dll
Resource
win10-en-20210920
Behavioral task
behavioral13
Sample
2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll
Resource
win7v20210408
Behavioral task
behavioral14
Sample
2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll
Resource
win10-en-20210920
Behavioral task
behavioral15
Sample
336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da.dll
Resource
win7-en-20210920
Behavioral task
behavioral16
Sample
336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da.dll
Resource
win10v20210408
Behavioral task
behavioral17
Sample
417c1828d98ba4f05f7a2edb71a9105f0aebf3d554393970b96e59d4db7b4473.dll
Resource
win7-en-20210920
Behavioral task
behavioral18
Sample
417c1828d98ba4f05f7a2edb71a9105f0aebf3d554393970b96e59d4db7b4473.dll
Resource
win10v20210408
Behavioral task
behavioral19
Sample
4d3095c7965c7bdd32b81b72c95f767134915cf08ebe1237721ed5208de4beee.dll
Resource
win7-en-20210920
Behavioral task
behavioral20
Sample
4d3095c7965c7bdd32b81b72c95f767134915cf08ebe1237721ed5208de4beee.dll
Resource
win10v20210408
Behavioral task
behavioral21
Sample
54e526fe059a3f25cdaed954e32f44eadffb3e51548658409468dcf2d63b634c.dll
Resource
win7-en-20210920
Behavioral task
behavioral22
Sample
54e526fe059a3f25cdaed954e32f44eadffb3e51548658409468dcf2d63b634c.dll
Resource
win10-en-20210920
Behavioral task
behavioral23
Sample
6402b33d729c8bb44881747a8f397f4aec408bf5e18b9af6fd86cdfa3f96323b.dll
Resource
win7v20210408
Behavioral task
behavioral24
Sample
6402b33d729c8bb44881747a8f397f4aec408bf5e18b9af6fd86cdfa3f96323b.dll
Resource
win10-en-20210920
Behavioral task
behavioral25
Sample
64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb.dll
Resource
win7v20210408
Behavioral task
behavioral26
Sample
64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb.dll
Resource
win10-en-20210920
Behavioral task
behavioral27
Sample
671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e.dll
Resource
win7v20210408
Behavioral task
behavioral28
Sample
671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e.dll
Resource
win10-en-20210920
Behavioral task
behavioral29
Sample
67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce.dll
Resource
win7v20210408
Behavioral task
behavioral30
Sample
67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce.dll
Resource
win10-en-20210920
Behavioral task
behavioral31
Sample
6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb.dll
Resource
win7-en-20210920
Behavioral task
behavioral32
Sample
6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb.dll
Resource
win10v20210408
General
-
Target
671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e.dll
-
Size
334KB
-
MD5
84a32095bcbc0ed694f09f1dd8f2a70f
-
SHA1
23f7334db6979f04d5a2a9a846f82c526bfe6736
-
SHA256
671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e
-
SHA512
e3db14700e24210d1e2f1c19fcbb1b7074d73f5cdc4cbaf737b9a92a4f3b8d9b71efaa450aac9f7f4baef1ca8463f0668a3d72b888e0d39195e4c6115de5012a
Malware Config
Extracted
squirrelwaffle
http://spiritofprespa.com/9783Tci2SGF6
http://amjsys.com/RIZszf8vR
http://hrms.prodigygroupindia.com/SKyufGZV
http://centralfloridaasphalt.com/GCN0FChS
http://jhehosting.com/rUuKheB7
http://shoeclearanceoutlet.co.uk/46awDTJjI4l
http://kmslogistik.com/aS1mjTkJIy
http://bartek-lenart.pl/1bWJ57V9vx
http://voip.voipcallhub.com/ZVmfdGHs4T
http://mercyfoundationcio.org/XF9aQrXnakeG
http://key4net.com/a8A2kcc1J
http://chaturanga.groopy.com/mxN3lxZoVApc
http://voipcallhub.com/ilGht5r26
http://ems.prodigygroupindia.com/v5RvVJTz
http://novamarketing.com.pk/k8l36uus
http://lenartsa.webd.pro/fz16DjmKmHtl
http://lead.jhinfotech.co/YERjiAMaupaz
-
blocklist
94.46.179.80
206.189.205.251
88.242.66.45
85.75.110.214
87.104.3.136
207.244.91.171
49.230.88.160
91.149.252.75
91.149.252.88
92.211.109.152
178.0.250.168
88.69.16.230
95.223.77.160
99.234.62.23
2.206.105.223
84.222.8.201
89.183.239.142
5.146.132.101
77.7.60.154
45.41.106.122
45.74.72.13
74.58.152.123
88.87.68.197
211.107.25.121
109.70.100.25
185.67.82.114
207.102.138.19
204.101.161.14
193.128.108.251
111.7.100.17
111.7.100.16
74.125.210.62
74.125.210.36
104.244.74.57
185.220.101.145
185.220.101.144
185.220.101.18
185.220.100.246
185.220.101.228
185.220.100.243
185.220.101.229
185.220.101.147
185.220.102.250
185.220.100.241
199.195.251.84
213.164.204.94
74.125.213.7
74.125.213.9
185.220.100.249
37.71.173.58
93.2.220.100
188.10.191.109
81.36.17.247
70.28.47.118
45.133.172.222
108.41.227.196
37.235.53.46
162.216.47.22
154.3.42.51
45.86.200.60
212.230.181.152
185.192.70.11
14.33.131.72
94.46.179.80
206.189.205.251
178.255.172.194
84.221.205.40
155.138.242.103
178.212.98.156
85.65.32.191
31.167.184.201
88.242.66.45
36.65.102.42
203.213.127.79
85.75.110.214
93.78.214.187
204.152.81.185
183.171.72.218
168.194.101.130
87.104.3.136
92.211.196.33
197.92.140.125
207.244.91.171
49.230.88.160
196.74.16.153
91.149.252.75
91.149.252.88
92.206.15.202
82.21.114.63
92.211.109.152
178.0.250.168
178.203.145.135
85.210.36.4
199.83.207.72
86.132.134.203
88.69.16.230
99.247.129.88
37.201.195.12
87.140.192.0
88.152.185.188
87.156.177.91
99.229.57.160
95.223.77.160
88.130.54.214
99.234.62.23
2.206.105.223
94.134.179.130
84.221.255.199
84.222.8.201
89.183.239.142
87.158.21.26
93.206.148.216
5.146.132.101
77.7.60.154
95.223.75.85
162.254.173.187
50.99.254.163
45.41.106.122
99.237.13.3
45.74.72.13
108.171.64.202
74.58.152.123
216.209.253.121
88.87.68.197
211.107.25.121
109.70.100.25
185.67.82.114
207.102.138.19
204.101.161.14
193.128.108.251
111.7.100.17
111.7.100.16
74.125.210.62
74.125.210.36
104.244.74.57
185.220.101.145
185.220.101.144
185.220.101.18
185.220.100.246
185.220.101.228
185.220.100.243
185.220.101.229
185.220.101.147
185.220.102.250
Signatures
-
SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
-
Squirrelwaffle Payload 2 IoCs
resource yara_rule behavioral28/memory/504-118-0x0000000074AF0000-0x0000000074B52000-memory.dmp squirrelwaffle behavioral28/memory/504-117-0x0000000074AF0000-0x0000000074B01000-memory.dmp squirrelwaffle -
Blocklisted process makes network request 4 IoCs
flow pid Process 24 504 rundll32.exe 27 504 rundll32.exe 28 504 rundll32.exe 29 504 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2016 wrote to memory of 504 2016 rundll32.exe 70 PID 2016 wrote to memory of 504 2016 rundll32.exe 70 PID 2016 wrote to memory of 504 2016 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e.dll,#12⤵
- Blocklisted process makes network request
PID:504
-