squirrelwaffle | 50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af

Analysis

max time kernel
142s
max time network
142s
platform
windows10_x64
resource
win10-en-20211208
submitted
30-01-2022 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af.dll
Size

333KB
MD5

89f3552453768e9e7474c4815fd5610f
SHA1

c3ce353c9c460b1dc40248738dfbcdbcdcccac7d
SHA256

50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af
SHA512

d99f5e068a7b516c4024cd18bcc567b555aadec3d9e35593061563c7f26f9f28162d5b0bd7cba0739dc654e04d68c69d66b9bb065faafb570451fe408fc15d95

Score

10^/10

squirrelwaffle downloader suricata

Malware Config

Extracted

Family

squirrelwaffle

http://atertreat.in/5iPPVRKPPX9

http://incentivaconsultores.com.co/55jHpKCc9DWy

http://cdelean.org/0qvbbmu9g

http://bazy.ps/M6SjrMSYC

http://sukmabali.com/ZXxcLYs3rzRQ

http://bugwilliam.tk/cbB56YrugdbW

http://bestbeatsgh.com/42D7OwuPen

http://krumaila.com/UZ4NdDoDh4Tu

http://razehub.com/NN70nExbtLO

http://arcb.ro/aHUUNxE3Me5

http://cfmi.tg/m40YS6gDO0

http://sweetlittle.mx/ZCXP0dT2h

http://alkimia-prod.com/nT0imyzmo

http://almexperts.co.za/fEoJ3pdWZbF

Signatures

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
suricata

Squirrelwaffle Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3972-116-0x0000000010000000-0x000000001004D000-memory.dmp	squirrelwaffle

Blocklisted process makes network request 5 IoCs

flow	pid	Process
19	3972	rundll32.exe
26	3972	rundll32.exe
31	3972	rundll32.exe
33	3972	rundll32.exe
35	3972	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 3972	808	rundll32.exe	68
PID 808 wrote to memory of 3972	808	rundll32.exe	68
PID 808 wrote to memory of 3972	808	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:3972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3972-115-0x0000000000C00000-0x0000000000C23000-memory.dmp

Filesize
140KB

Download
memory/3972-116-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download