Overview

overview

10

Static

static

test1.test.dll

windows7_x64

10

test1.test.dll

windows10_x64

10

Resubmissions

31/10/2021, 09:06

211031-k2rnrafge710

27/10/2021, 10:32

211027-mky3lsbga810

Analysis

  • max time kernel
    304s
  • max time network
    1814s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    31/10/2021, 09:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    test1.test.dll
  • Size 447KB
  • Sample211031-k2rnrafge7
  • SHA256 0278a0ff3a6fc56294995c86444bba7f264b945ed29e91d62e9256157ce6d15e
  • MD5 SHA1 SHA512
Score
10/10
squirrelwaffledownloader

Malware Config

Extracted

Family

  • squirrelwaffle

C2

  • http://deanandwilconstruction.com/UXEvfuIlhws

  • http://arimeto.lv/Nm70oAfwB

  • http://gitamschool.com/oZbs0Oqw7uv

  • http://eresourcesmoneymarket.com/JbVwdgaV6l

  • http://flyershipmanager.com/SGAsORYsywt

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

    downloadersquirrelwaffle
  • Squirrelwaffle Payload 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\test1.test.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\test1.test.dll,#1
      2⤵
        PID:4060
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 696
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4556

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/4060-116-0x0000000003390000-0x0000000003391000-memory.dmp
          Download

          memory/4060-117-0x0000000005260000-0x0000000005274000-memory.dmp
          Download

          memory/4060-118-0x0000000005280000-0x0000000005292000-memory.dmp
          Download