Overview

overview

10

Static

static

eebe0dcb93...6a.dll

windows7_x64

10

eebe0dcb93...6a.dll

windows10_x64

10

Analysis

  • max time kernel
    118s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    21-01-2022 22:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eebe0dcb937e1c62ebe8343069d964521e216bf05ae704bd5d781f5f4625446a.dll

  • Size

    438KB

  • MD5

    48e941bfbd71e48891e4b1f316aca951

  • SHA1

    8750da7a113fdbec8eb27e8bf03ee65c279788c9

  • SHA256

    eebe0dcb937e1c62ebe8343069d964521e216bf05ae704bd5d781f5f4625446a

  • SHA512

    35323bf24c4aca67d8cbde8915df661ee5919468c5603f22aedc3eea26753ec4d2c82b27884639ec0b07c35e0f283299e55bbf4bddbcef26617b364d66b2ac7d

Score
10/10
squirrelwaffledownloader

Malware Config

Extracted

Family

squirrelwaffle

C2

http://deanandwilconstruction.com/UXEvfuIlhws

http://arimeto.lv/Nm70oAfwB

http://gitamschool.com/oZbs0Oqw7uv

http://eresourcesmoneymarket.com/JbVwdgaV6l

http://flyershipmanager.com/SGAsORYsywt
Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

    downloadersquirrelwaffle
  • Squirrelwaffle Payload 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\eebe0dcb937e1c62ebe8343069d964521e216bf05ae704bd5d781f5f4625446a.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\eebe0dcb937e1c62ebe8343069d964521e216bf05ae704bd5d781f5f4625446a.dll,#1
      2⤵
        PID:2480
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 688
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:776

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2480-118-0x0000000000C40000-0x0000000000CB1000-memory.dmp

      Filesize

      452KB

      Download

    • memory/2480-119-0x0000000000780000-0x0000000000781000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2480-120-0x00000000012D0000-0x00000000012E4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2480-121-0x0000000001300000-0x0000000001312000-memory.dmp

      Filesize

      72KB

      Download