squirrelwaffle | 50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-en-20211208
submitted
30-01-2022 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af.dll
Size

333KB
MD5

89f3552453768e9e7474c4815fd5610f
SHA1

c3ce353c9c460b1dc40248738dfbcdbcdcccac7d
SHA256

50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af
SHA512

d99f5e068a7b516c4024cd18bcc567b555aadec3d9e35593061563c7f26f9f28162d5b0bd7cba0739dc654e04d68c69d66b9bb065faafb570451fe408fc15d95

Score

10^/10

squirrelwaffle downloader

Malware Config

Extracted

Family

squirrelwaffle

http://atertreat.in/5iPPVRKPPX9

http://incentivaconsultores.com.co/55jHpKCc9DWy

http://cdelean.org/0qvbbmu9g

http://bazy.ps/M6SjrMSYC

http://sukmabali.com/ZXxcLYs3rzRQ

http://bugwilliam.tk/cbB56YrugdbW

http://bestbeatsgh.com/42D7OwuPen

http://krumaila.com/UZ4NdDoDh4Tu

http://razehub.com/NN70nExbtLO

http://arcb.ro/aHUUNxE3Me5

http://cfmi.tg/m40YS6gDO0

http://sweetlittle.mx/ZCXP0dT2h

http://alkimia-prod.com/nT0imyzmo

http://almexperts.co.za/fEoJ3pdWZbF

Signatures

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle

Squirrelwaffle Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1372-57-0x0000000010000000-0x000000001004D000-memory.dmp	squirrelwaffle

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1372	1160	rundll32.exe	27
PID 1160 wrote to memory of 1372	1160	rundll32.exe	27
PID 1160 wrote to memory of 1372	1160	rundll32.exe	27
PID 1160 wrote to memory of 1372	1160	rundll32.exe	27
PID 1160 wrote to memory of 1372	1160	rundll32.exe	27
PID 1160 wrote to memory of 1372	1160	rundll32.exe	27
PID 1160 wrote to memory of 1372	1160	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af.dll,#1
  2⤵
  PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1372-56-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/1372-57-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download