Overview

overview

10

Static

static

37168c041e...67.dll

windows7_x64

10

37168c041e...67.dll

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    30-01-2022 15:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    37168c041e711667aa22ab9a29a2f8251e9c6ff7d9e2ae7f14dc0cd08f51cc67.dll

  • Size

    261KB

  • MD5

    08d5542f204aafc1f6c191aa4e8318f2

  • SHA1

    053f50842c4ac280868f71c16746d411bcb4e29e

  • SHA256

    37168c041e711667aa22ab9a29a2f8251e9c6ff7d9e2ae7f14dc0cd08f51cc67

  • SHA512

    5a9882217ecdd4b2575db10526c96aed75917cc8480771bbfabe6b34bbe817df14d4394a3bd8de708212bc1d95a010894fd1980a5f6c590ccde4fa252abebec7

Score
10/10
squirrelwaffledownloadersuricata

Malware Config

Extracted

Family

squirrelwaffle

C2

http://deanandwilconstruction.com/UXEvfuIlhws

http://arimeto.lv/Nm70oAfwB

http://gitamschool.com/oZbs0Oqw7uv

http://eresourcesmoneymarket.com/JbVwdgaV6l

http://flyershipmanager.com/SGAsORYsywt
Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

    downloadersquirrelwaffle
  • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    suricata
  • Squirrelwaffle Payload 1 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\37168c041e711667aa22ab9a29a2f8251e9c6ff7d9e2ae7f14dc0cd08f51cc67.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\37168c041e711667aa22ab9a29a2f8251e9c6ff7d9e2ae7f14dc0cd08f51cc67.dll,#1
      2⤵
      • Blocklisted process makes network request
      PID:3972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3972-116-0x0000000010000000-0x0000000010043000-memory.dmp

    Filesize

    268KB

    Download

  • memory/3972-115-0x0000000000F30000-0x0000000000F4D000-memory.dmp

    Filesize

    116KB

    Download