Analysis

  • max time kernel
    145s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    21-01-2022 22:55

General

  • Target

    ea6de939622eb8e3897d8505bd7851364655ec770d135fbcc68609399c8a1de1.dll

  • Size

    275KB

  • MD5

    fcd50453a8143859cb2c61e1714b4291

  • SHA1

    3571aaf77ed486877e01dffc99d730f4b45ae265

  • SHA256

    ea6de939622eb8e3897d8505bd7851364655ec770d135fbcc68609399c8a1de1

  • SHA512

    11032e9b439c489ea0722955ef382761a7734455d6b5a5b04d1e982a30bce356174d3cc47931474158cee8f7474bee71747239819ea1c9b37fe3ddd4b0796365

Malware Config

Extracted

Family

squirrelwaffle

C2

http://deanandwilconstruction.com/UXEvfuIlhws

http://arimeto.lv/Nm70oAfwB

http://gitamschool.com/oZbs0Oqw7uv

http://eresourcesmoneymarket.com/JbVwdgaV6l

http://flyershipmanager.com/SGAsORYsywt

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

  • Squirrelwaffle Payload 1 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea6de939622eb8e3897d8505bd7851364655ec770d135fbcc68609399c8a1de1.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea6de939622eb8e3897d8505bd7851364655ec770d135fbcc68609399c8a1de1.dll,#1
      2⤵
      • Blocklisted process makes network request
      PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3796-115-0x00000000009B0000-0x00000000009CE000-memory.dmp

    Filesize

    120KB

  • memory/3796-116-0x0000000010000000-0x0000000010044000-memory.dmp

    Filesize

    272KB