Resubmissions

01-11-2021 12:31

211101-pp5r3ahha4 10

31-10-2021 09:03

211031-k1bwxacfaq 10

14-10-2021 01:44

211014-b6aflafeg4 10

Analysis

  • max time kernel
    3883s
  • max time network
    3898s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    31-10-2021 09:03

General

  • Target

    e5efde974017a12a573548f12b5473887601c897e8660eb57803c18523f72815.dll

  • Size

    518KB

  • MD5

    3e809308f937a1252c9d4975dd21f47f

  • SHA1

    ae9e57fac6310a27e31ebc1e67d0cf6b206d455a

  • SHA256

    e5efde974017a12a573548f12b5473887601c897e8660eb57803c18523f72815

  • SHA512

    d0312291cb56bdce01ba3067520bf22daa69814f7dc9812d87fb54f20a60f639d05af8cc7db9c7f10d4451386044cb941303f6c9dbc274ac08922d9bd30a0906

Malware Config

Extracted

Family

squirrelwaffle

C2

http://agora.360cyberlink.com/wpuDolwbH9c9

http://panel.betfredtakeaway.com/awJPDGElQ

http://believeinus.net/S6y8WsHm

http://onlinecourses.mirrainternationaluniversity.com/VnCSkt13PkuT

http://reward.tyrehamperpromotion.co.uk/GWJ3gHMtUdk

http://panels.betfredtakeaway.com/0PKIQI4OFxD

http://ambassade-mauritanie-rabat.net/hovwkJJaIt8

http://bitcoinup.bafflepoetry.org/uTyCcQUDkCX3

http://pwcgov-x.gq/doMZFSHYs

http://business-a.ml/lDyw7Vs3x

http://unifarma.com.br/6GREencD

http://digitalmaster.online/rgzce1W5g

http://patatec.com/OTfcXmew

http://megasoftsol.com/R26csFnDY

http://authentification.scanandrace.com/m1xwraBcBFN

http://new.actsgeneration.org/1vXSPxRR3bR

http://lagochapala.com.mx/DplUgNSqWfc

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

  • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

  • Squirrelwaffle Payload 1 IoCs
  • Blocklisted process makes network request 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5efde974017a12a573548f12b5473887601c897e8660eb57803c18523f72815.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4000
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5efde974017a12a573548f12b5473887601c897e8660eb57803c18523f72815.dll,#1
      2⤵
      • Blocklisted process makes network request
      PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4036-119-0x0000000000C60000-0x0000000000C6E000-memory.dmp

    Filesize

    56KB

  • memory/4036-120-0x0000000073DE0000-0x0000000073E6A000-memory.dmp

    Filesize

    552KB