Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    21-01-2022 22:56

General

  • Target

    e81ebc49b264484094740cf4ca4b08c6e161cc049f752ae3c96824351a932930.dll

  • Size

    271KB

  • MD5

    bed48005f3b47c5d1d9114c735ece89a

  • SHA1

    b8a3c880fcf97c2f9b3023cc1d104744774705db

  • SHA256

    e81ebc49b264484094740cf4ca4b08c6e161cc049f752ae3c96824351a932930

  • SHA512

    13c6b445d568bf0dc864f8a2b492b59038a766c139a728d8bcb9e02810720967e68b913607941bf06361b6dee96a33dfc7dccf19eb0638eb98cd0c1b3e5d6028

Malware Config

Extracted

Family

squirrelwaffle

C2

http://deanandwilconstruction.com/UXEvfuIlhws

http://arimeto.lv/Nm70oAfwB

http://gitamschool.com/oZbs0Oqw7uv

http://eresourcesmoneymarket.com/JbVwdgaV6l

http://flyershipmanager.com/SGAsORYsywt

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

  • Squirrelwaffle Payload 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e81ebc49b264484094740cf4ca4b08c6e161cc049f752ae3c96824351a932930.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1068
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\e81ebc49b264484094740cf4ca4b08c6e161cc049f752ae3c96824351a932930.dll,#1
      2⤵
        PID:1088

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1088-53-0x0000000075341000-0x0000000075343000-memory.dmp

      Filesize

      8KB

    • memory/1088-54-0x0000000000150000-0x000000000016D000-memory.dmp

      Filesize

      116KB

    • memory/1088-55-0x0000000010000000-0x0000000010043000-memory.dmp

      Filesize

      268KB