Analysis

  • max time kernel
    122s
  • max time network
    129s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    21-01-2022 22:55

General

  • Target

    e9a78fad11f22336ffbac7382d28ebee8a53953bb99a91754fd882e3bbd338a2.dll

  • Size

    436KB

  • MD5

    d71ac8c5859ce3413ee2606ae93c9147

  • SHA1

    2579c1bacd6a615c524bd4089137b9acd6686f12

  • SHA256

    e9a78fad11f22336ffbac7382d28ebee8a53953bb99a91754fd882e3bbd338a2

  • SHA512

    01aad97146082e6252f009929556a291ae3b2dbb0fd6fa6166dfb0490dbba384dfc065703222d073f0e2d486ca72df291958ec7f485e323daada006e438b3060

Malware Config

Extracted

Family

squirrelwaffle

C2

http://deanandwilconstruction.com/UXEvfuIlhws

http://arimeto.lv/Nm70oAfwB

http://gitamschool.com/oZbs0Oqw7uv

http://eresourcesmoneymarket.com/JbVwdgaV6l

http://flyershipmanager.com/SGAsORYsywt

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

  • Squirrelwaffle Payload 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9a78fad11f22336ffbac7382d28ebee8a53953bb99a91754fd882e3bbd338a2.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9a78fad11f22336ffbac7382d28ebee8a53953bb99a91754fd882e3bbd338a2.dll,#1
      2⤵
        PID:2776
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 692
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:708

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2776-115-0x0000000000AC0000-0x0000000000B31000-memory.dmp

      Filesize

      452KB

    • memory/2776-116-0x00000000004E0000-0x000000000062A000-memory.dmp

      Filesize

      1.3MB

    • memory/2776-117-0x0000000003FD0000-0x0000000003FE4000-memory.dmp

      Filesize

      80KB

    • memory/2776-118-0x0000000004000000-0x0000000004012000-memory.dmp

      Filesize

      72KB