Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-01-2022 23:25
Static task
static1
Behavioral task
behavioral1
Sample
9e9c6689c1a57db3b76e61334665509bba62f0fa0c3156ea4a4328941d31e0ad.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
9e9c6689c1a57db3b76e61334665509bba62f0fa0c3156ea4a4328941d31e0ad.dll
Resource
win10-en-20211208
General
-
Target
9e9c6689c1a57db3b76e61334665509bba62f0fa0c3156ea4a4328941d31e0ad.dll
-
Size
314KB
-
MD5
1e9b10996003528a19cab03c1d55597f
-
SHA1
874f8a01ba0500f4cd919408bd21336889b244c3
-
SHA256
9e9c6689c1a57db3b76e61334665509bba62f0fa0c3156ea4a4328941d31e0ad
-
SHA512
fade6fb07831b31e80cb515f93b2aa1ac597989a154c56056721be9941807987363fb417f15fc8ed7e05bd33f5ad0c1767a1958b3854d481856288628f06779e
Malware Config
Extracted
squirrelwaffle
http://atertreat.in/5iPPVRKPPX9
http://incentivaconsultores.com.co/55jHpKCc9DWy
http://cdelean.org/0qvbbmu9g
http://bazy.ps/M6SjrMSYC
http://sukmabali.com/ZXxcLYs3rzRQ
http://bugwilliam.tk/cbB56YrugdbW
http://bestbeatsgh.com/42D7OwuPen
http://krumaila.com/UZ4NdDoDh4Tu
http://razehub.com/NN70nExbtLO
http://arcb.ro/aHUUNxE3Me5
http://cfmi.tg/m40YS6gDO0
http://sweetlittle.mx/ZCXP0dT2h
http://alkimia-prod.com/nT0imyzmo
http://almexperts.co.za/fEoJ3pdWZbF
Signatures
-
SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
-
Squirrelwaffle Payload 1 IoCs
resource yara_rule behavioral1/memory/1268-57-0x0000000010000000-0x000000001004D000-memory.dmp squirrelwaffle -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1616 wrote to memory of 1268 1616 rundll32.exe 27 PID 1616 wrote to memory of 1268 1616 rundll32.exe 27 PID 1616 wrote to memory of 1268 1616 rundll32.exe 27 PID 1616 wrote to memory of 1268 1616 rundll32.exe 27 PID 1616 wrote to memory of 1268 1616 rundll32.exe 27 PID 1616 wrote to memory of 1268 1616 rundll32.exe 27 PID 1616 wrote to memory of 1268 1616 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e9c6689c1a57db3b76e61334665509bba62f0fa0c3156ea4a4328941d31e0ad.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e9c6689c1a57db3b76e61334665509bba62f0fa0c3156ea4a4328941d31e0ad.dll,#12⤵PID:1268
-