Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    30-01-2022 14:53

General

  • Target

    53376f9f8fd56a8f2a639faa25bdd2c2da6587a017b0d6dd624533bb5690a99a.dll

  • Size

    222KB

  • MD5

    d383cbc5aa2f06a70d0a5afd2130b183

  • SHA1

    1a1a5bf96c35f428b86de7924527a9689250976d

  • SHA256

    53376f9f8fd56a8f2a639faa25bdd2c2da6587a017b0d6dd624533bb5690a99a

  • SHA512

    3e2f06d290fe42eaf315d0c57378784a312947d407c4459b6a0cf8559e023d647a1cd5aadbdc6c4e82288ba932a73bf23b92194c54dfb908c9e5bedbd5b08a3f

Malware Config

Extracted

Family

squirrelwaffle

C2

http://hutraders.com/0eeUtmJf8O

http://goodartishard.com/0JXDM9kMwx

http://now.byteinsure.com/tnjUrmlhN

http://asceaub.com/Xl8UCLSU

http://colchonesmanzur.com/GjVgBnKaNIC

http://sistemasati.com/0SzGNkx6P

http://maldivehost.net/zLIisQRWZI9

http://lrdgon.org/l7r96tjAJ

http://binnawaz.com.pk/jhSZGWS76C

http://fhstorse.com/vJlgdjJnpIop

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

  • Squirrelwaffle Payload 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\53376f9f8fd56a8f2a639faa25bdd2c2da6587a017b0d6dd624533bb5690a99a.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:804
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\53376f9f8fd56a8f2a639faa25bdd2c2da6587a017b0d6dd624533bb5690a99a.dll,#1
      2⤵
        PID:1648

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1648-54-0x0000000075341000-0x0000000075343000-memory.dmp

      Filesize

      8KB

    • memory/1648-55-0x00000000021F0000-0x000000000620A000-memory.dmp

      Filesize

      64.1MB

    • memory/1648-56-0x0000000010000000-0x0000000014030000-memory.dmp

      Filesize

      64.2MB