Resubmissions

31-10-2021 09:06

211031-k2rnrafge7 10

27-10-2021 10:32

211027-mky3lsbga8 10

Analysis

  • max time kernel
    1800s
  • max time network
    1800s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    31-10-2021 09:06

General

  • Target

    test1.test.dll

  • Size

    447KB

  • MD5

    7df7e578e914d992be61f8057adc25cd

  • SHA1

    1fe5e1eaf8ab95478635664ee2141dbe52e5a5e8

  • SHA256

    0278a0ff3a6fc56294995c86444bba7f264b945ed29e91d62e9256157ce6d15e

  • SHA512

    9354f850121ff550e4b7ce6f1e60b36f4a514ceef55a27baab6dc4ecc17b4dd181c5e8820f95558445f871b19c3c46ed40fc419ebc06218b3aec7ccb4746ea28

Malware Config

Extracted

Family

squirrelwaffle

C2

http://deanandwilconstruction.com/UXEvfuIlhws

http://arimeto.lv/Nm70oAfwB

http://gitamschool.com/oZbs0Oqw7uv

http://eresourcesmoneymarket.com/JbVwdgaV6l

http://flyershipmanager.com/SGAsORYsywt

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

  • Squirrelwaffle Payload 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\test1.test.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\test1.test.dll,#1
      2⤵
        PID:1736

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1736-56-0x0000000076431000-0x0000000076433000-memory.dmp

      Filesize

      8KB

    • memory/1736-57-0x0000000000230000-0x00000000002A1000-memory.dmp

      Filesize

      452KB

    • memory/1736-59-0x0000000000510000-0x0000000000524000-memory.dmp

      Filesize

      80KB

    • memory/1736-58-0x0000000000200000-0x0000000000201000-memory.dmp

      Filesize

      4KB

    • memory/1736-60-0x00000000009A0000-0x00000000009B2000-memory.dmp

      Filesize

      72KB