Resubmissions
14-10-2021 12:23
211014-pkhrqsaccp 1006-10-2021 13:07
211006-qc4vnsbdem 1006-10-2021 07:58
211006-jtztqaagc4 10Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10_x64 -
resource
win10-de-20210920 -
submitted
14-10-2021 12:23
Static task
static1
Behavioral task
behavioral1
Sample
da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3 (1).dll
Resource
win10-de-20210920
General
-
Target
da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3 (1).dll
-
Size
475KB
-
MD5
267aa0f6d02c470db4951b3d9b80d8f7
-
SHA1
a9627760018699a0ce48499fd58b43e3d33c51c7
-
SHA256
da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3
-
SHA512
cf0ab54048b096bf05bc4f222473a962f2e18133e195165b582f041ee3b38536cc4e67a49dcc762c838aaeafcd164d63765ac42d58762db9f21217c12bc4eff6
Malware Config
Extracted
squirrelwaffle
http://profitshub.in/eJDLM6siEv
http://hynot-adventures.com/siRmGWRAqRR
http://giversherbalproducts.com/lBawcxb5
http://opulent-imports.com/DlOBqKAf
http://nitro2point0.com/9SqebpSMu
http://streamline-trade.com/7fTwg0V7
http://sologicgroup.com/hWo6FObvrdp
http://pedroaros.cl/gnYxifRY
http://apimar.eu/QFm9qbfjT
http://baetrading.com/IfpAV6qS
http://ditrpshop.in/oHbAKuM0
http://surveillantfire.com/s6ImD3DAJs
http://dhananialegalaid.com/VIVB6kFar
http://aulaintelimundo.com/n1n3Sh4NSO08
http://muwatin.net/IvyhnWs8j
http://nkp.hr/a9TmwEDR
http://kvrassociates.net/Y3kzp0WtE0
http://marianaleyton.com/4ByNgaVdId6
Signatures
-
SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
-
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
-
Squirrelwaffle Payload 1 IoCs
resource yara_rule behavioral1/memory/4316-117-0x0000000010000000-0x0000000014574000-memory.dmp squirrelwaffle -
Blocklisted process makes network request 6 IoCs
flow pid Process 30 4316 rundll32.exe 46 4316 rundll32.exe 57 4316 rundll32.exe 62 4316 rundll32.exe 72 4316 rundll32.exe 79 4316 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4268 wrote to memory of 4316 4268 rundll32.exe 76 PID 4268 wrote to memory of 4316 4268 rundll32.exe 76 PID 4268 wrote to memory of 4316 4268 rundll32.exe 76
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3 (1).dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3 (1).dll",#12⤵
- Blocklisted process makes network request
PID:4316
-