squirrelwaffle | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb.dll
Size

439KB
MD5

22aef4558853a72dd07ff9513a6b9dbf
SHA1

52a914b43dfa44910ab649be77a57db631d038ee
SHA256

64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb
SHA512

550f72f4d6186869893b2dc6536b3ce9bcb7843b0db726a1d9fb118291b1e96d642dfb57369b85ff58c41b38d6c40f6853d1da752f589aa419cb1f4d35381be4

Score

10^/10

squirrelwaffle downloader

Malware Config

Extracted

Family

squirrelwaffle

http://deanandwilconstruction.com/UXEvfuIlhws

http://arimeto.lv/Nm70oAfwB

http://gitamschool.com/oZbs0Oqw7uv

http://eresourcesmoneymarket.com/JbVwdgaV6l

http://flyershipmanager.com/SGAsORYsywt

Attributes

blocklist
94.46.179.80

206.189.205.251

88.242.66.45

85.75.110.214

87.104.3.136

207.244.91.171

49.230.88.160

91.149.252.75

91.149.252.88

92.211.109.152

178.0.250.168

88.69.16.230

95.223.77.160

99.234.62.23

2.206.105.223

84.222.8.201

89.183.239.142

5.146.132.101

77.7.60.154

45.41.106.122

45.74.72.13

74.58.152.123

88.87.68.197

109.70.100.25

185.67.82.114

207.102.138.19

204.101.161.14

193.128.108.251

111.7.100.17

111.7.100.16

74.125.210.62

74.125.210.36

104.244.74.57

185.220.101.145

185.220.101.144

185.220.101.18

185.220.100.246

185.220.101.228

185.220.100.243

185.220.101.229

185.220.101.147

185.220.102.250

185.220.100.241

199.195.251.84

213.164.204.94

74.125.213.7

74.125.213.9

185.220.100.249

37.71.173.58

93.2.220.100

188.10.191.109

81.36.17.247

70.28.47.118

45.133.172.222

108.41.227.196

37.235.53.46

162.216.47.22

154.3.42.51

45.86.200.60

212.230.181.152

185.192.70.11

37.142.65.69

87.166.51.31

178.198.76.175

128.90.172.136

172.58.227.224

201.77.112.133

64.124.12.162

87.166.51.28

104.244.72.115

109.70.100.23

192.145.127.220

194.186.142.122

185.207.249.217

52.250.42.144

45.86.201.156

195.245.199.125

213.33.190.70

154.61.71.13

154.13.1.22

191.96.185.151

40.94.25.22

40.94.25.39

40.94.25.5

40.94.25.79

40.94.25.69

40.94.25.71

40.94.25.60

40.94.25.64

40.94.25.29

40.94.25.23

40.94.25.89

40.94.26.165

40.94.26.210

40.94.26.208

40.94.26.166

40.94.26.216

40.94.26.173

40.94.26.182

40.94.35.75

40.94.35.97

40.94.35.27

40.94.35.38

40.94.35.46

40.94.35.76

40.94.35.70

40.94.35.80

40.94.35.98

40.94.35.40

45.86.200.23

198.167.212.98

40.94.31.87

40.94.31.85

40.94.31.29

40.94.31.97

40.94.31.88

40.94.31.80

40.94.31.65

198.167.195.112

40.94.31.58

40.94.31.48

40.94.31.64

40.94.31.26

40.94.31.66

40.94.31.90

40.94.31.46

40.94.31.47

212.119.227.184

72.12.194.93

72.12.194.94

72.12.194.92

134.209.213.55

35.198.84.59

89.208.29.2

40.94.30.159

40.94.30.139

40.94.30.152

40.94.30.167

40.94.30.164

40.94.30.166

40.94.30.174

40.94.30.151

154.61.71.53

40.94.30.157

40.94.30.136

40.94.30.149

52.154.162.74

213.33.190.161

83.84.25.214

162.251.62.154

188.241.177.152

92.211.110.221

185.183.107.236

72.12.194.90

40.94.25.36

40.94.29.4

40.94.25.50

40.94.29.31

40.94.25.31

40.94.29.41

40.94.31.5

40.94.25.80

40.94.29.82

40.94.31.81

40.94.25.96

40.94.29.59

40.94.31.3

40.94.25.58

40.94.31.61

40.94.31.49

40.94.31.54

40.94.31.62

40.94.31.70

40.94.30.211

40.94.30.148

40.94.30.218

40.94.30.147

40.94.30.129

40.94.31.15

40.94.30.169

40.94.31.36

40.94.30.223

40.94.30.203

95.211.36.179

64.233.172.102

153.246.206.71

198.167.193.35

90.187.12.209

37.49.116.179

52.167.22.240

160.177.96.15

185.123.143.220

167.99.172.253

40.94.36.81

86.107.21.203

24.37.31.38

71.19.154.84

192.160.102.170

216.251.130.74

49.44.76.43

109.147.65.157

86.217.130.91

178.174.15.54

86.242.244.97

92.46.70.105

81.201.234.26

78.94.217.60

141.226.236.91

95.26.228.102

89.208.29.3

213.33.190.205

213.33.190.121

5.154.174.45

23.154.177.3

195.65.152.138

93.231.174.227

185.220.101.132

54.36.101.21

72.12.194.91

46.14.116.174

141.19.232.57

185.220.101.149

45.74.46.69

157.230.210.133

82.199.130.36

104.237.193.28

187.46.138.56

195.164.49.162

156.146.49.135

195.164.49.191

79.104.209.54

35.245.134.90

20.52.139.186

189.139.144.151

94.31.102.187

39.43.45.71

107.189.10.143

39.43.123.57

106.75.76.179

194.186.142.131

210.22.129.194

45.130.83.77

154.6.16.175

162.247.73.192

107.189.1.160

185.107.47.215

46.166.139.111

185.56.80.65

185.220.100.245

209.141.59.180

77.247.181.163

185.220.101.137

185.220.100.242

104.244.76.13

185.83.214.69

185.220.100.252

185.112.146.73

185.57.82.28

89.187.171.116

66.220.242.222

39.43.72.17

5.171.90.80

185.152.32.77

23.129.64.157

92.151.9.187

106.75.31.237

122.167.79.251

109.70.100.33

199.249.230.154

64.233.172.108

64.233.172.106

64.233.172.104

77.247.181.165

107.189.12.240

79.142.76.203

193.128.114.34

185.92.26.59

185.65.210.119

70.39.159.79

70.39.159.29

151.48.26.15

151.48.26.15

2.228.159.178

188.174.248.154

188.174.248.154

95.90.198.182

95.90.198.182

193.0.200.36

193.0.200.36

151.127.13.232

89.97.249.158

212.115.152.225

185.217.117.179

199.249.230.164

80.233.134.134

109.74.154.92

65.39.88.250

90.84.192.187

37.70.202.24

85.203.45.30

109.190.93.219

151.8.114.194

176.235.38.106

149.56.99.85

138.128.136.169

213.82.23.224

192.42.123.107

128.90.151.188

162.245.206.249

85.203.45.40

95.211.95.242

185.220.102.251

66.203.112.160

193.128.108.246

193.128.108.242

31.204.150.74

34.141.245.25

122.167.85.191

212.6.86.133

171.25.193.25

149.3.170.147

162.247.74.217

109.70.100.34

89.208.29.5

79.104.209.91

79.104.209.157

194.186.142.205

198.167.217.20

198.167.193.112

204.101.161.31

198.167.219.82

195.74.76.222

87.118.110.27

185.247.225.43

193.128.108.250

188.212.135.7

106.75.75.245

86.142.177.106

185.192.69.77

198.167.209.37

59.144.163.235

193.128.108.243

31.204.152.150

87.166.49.39

82.127.202.176

58.40.175.6

92.222.212.17

88.123.105.51

45.114.130.4

216.251.130.75

187.22.129.46

187.22.129.46

45.153.160.129

80.155.50.158

80.155.50.158

212.234.209.161

213.9.159.210

88.149.207.35

88.149.207.35

88.149.207.35

37.159.148.162

151.8.6.86

91.62.233.251

109.3.219.42

109.3.219.42

109.3.219.42

196.23.168.132

192.87.28.103

207.244.70.35

79.104.209.172

89.208.29.6

195.239.51.18

79.104.209.52

194.154.78.73

185.220.102.240

109.70.100.27

208.68.5.17

185.191.124.143

45.153.160.130

163.172.213.212

193.128.108.245

51.83.131.42

109.62.69.3

109.62.69.3

147.135.68.11

209.58.188.133

193.128.108.253

94.242.243.171

185.183.106.148

185.220.102.248

109.70.100.20

37.58.58.249

69.167.10.41

109.62.69.2

45.141.56.7

104.244.74.55

193.128.108.247

185.31.175.243

45.61.185.125

185.57.82.27

122.182.203.3

82.221.105.78

37.187.196.70

45.153.160.138

89.163.252.12

193.128.108.252

198.167.199.100

198.167.199.106

70.39.116.252

193.128.108.248

188.43.68.132

79.104.209.46

213.33.190.122

95.25.38.53

80.255.7.72

212.119.227.132

212.119.227.169

194.186.142.52

38.132.118.67

37.120.143.139

193.128.108.249

66.249.88.48

66.249.88.50

66.249.88.46

104.244.74.28

198.96.155.3

205.185.124.200

109.70.100.36

193.189.100.202

185.31.175.215

84.147.60.16

45.242.1.134

5.22.190.138

84.147.62.235

89.208.29.7

194.154.78.130

106.75.66.75

185.217.1.11

103.254.153.204

198.167.201.23

185.31.175.231

23.184.48.9

18.27.197.252

107.189.11.153

128.199.56.132

104.248.166.43

192.145.127.221

185.100.87.202

94.46.179.80

206.189.205.251

178.255.172.194

84.221.205.40

155.138.242.103

178.212.98.156

85.65.32.191

31.167.184.201

88.242.66.45

36.65.102.42

203.213.127.79

85.75.110.214

93.78.214.187

204.152.81.185

183.171.72.218

168.194.101.130

87.104.3.136

92.211.196.33

197.92.140.125

207.244.91.171

49.230.88.160

196.74.16.153

91.149.252.75

91.149.252.88

92.206.15.202

82.21.114.63

92.211.109.152

178.0.250.168

178.203.145.135

85.210.36.4

199.83.207.72

86.132.134.203

88.69.16.230

99.247.129.88

37.201.195.12

87.140.192.0

88.152.185.188

87.156.177.91

99.229.57.160

95.223.77.160

88.130.54.214

99.234.62.23

2.206.105.223

94.134.179.130

84.221.255.199

84.222.8.201

89.183.239.142

87.158.21.26

93.206.148.216

5.146.132.101

77.7.60.154

95.223.75.85

162.254.173.187

50.99.254.163

45.41.106.122

99.237.13.3

45.74.72.13

108.171.64.202

74.58.152.123

216.209.253.121

88.87.68.197

211.107.25.121

109.70.100.25

185.67.82.114

207.102.138.19

204.101.161.14

193.128.108.251

111.7.100.17

111.7.100.16

74.125.210.62

74.125.210.36

104.244.74.57

185.220.101.145

185.220.101.144

185.220.101.18

185.220.100.246

185.220.101.228

185.220.100.243

185.220.101.229

185.220.101.147

185.220.102.250

185.220.100.241

199.195.251.84

213.164.204.94

74.125.213.7

74.125.213.9

177.38.183.13

185.220.100.249

85.55.1.73

85.55.1.73

37.71.173.58

82.65.34.224

93.2.220.100

188.10.191.109

24.100.23.115

81.36.17.247

90.161.75.4

213.194.157.212

117.211.140.154

Signatures

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle

Squirrelwaffle Payload 2 IoCs

Processes:

resource	yara_rule
behavioral14/memory/1908-120-0x0000000005100000-0x0000000005114000-memory.dmp	squirrelwaffle
behavioral14/memory/1908-121-0x0000000005130000-0x0000000005142000-memory.dmp	squirrelwaffle

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

892 1908 WerFault.exe rundll32.exe

pid	pid_target	process	target process
892	1908	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
892	WerFault.exe
892	WerFault.exe
892	WerFault.exe
892	WerFault.exe
892	WerFault.exe
892	WerFault.exe
892	WerFault.exe
892	WerFault.exe
892	WerFault.exe
892	WerFault.exe
892	WerFault.exe
892	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 892 WerFault.exe
Token: SeBackupPrivilege 892 WerFault.exe
Token: SeDebugPrivilege 892 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	892	WerFault.exe
Token: SeBackupPrivilege	892	WerFault.exe
Token: SeDebugPrivilege	892	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3052 wrote to memory of 1908	3052	rundll32.exe	rundll32.exe
PID 3052 wrote to memory of 1908	3052	rundll32.exe	rundll32.exe
PID 3052 wrote to memory of 1908	3052	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb.dll,#1
  2⤵
  PID:1908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 700
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-118-0x0000000000000000-mapping.dmp

Download
memory/1908-119-0x0000000003150000-0x000000000329A000-memory.dmp

Filesize
1.3MB

Download
memory/1908-120-0x0000000005100000-0x0000000005114000-memory.dmp

Filesize
80KB

Download
memory/1908-121-0x0000000005130000-0x0000000005142000-memory.dmp

Filesize
72KB

Download