Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    30-01-2022 15:54

General

  • Target

    269175619ab6161ea13a61bc860aaa06d274d8cac74c360d87e58e3b1f65e889.dll

  • Size

    270KB

  • MD5

    6ce3e2a6faff7588e22f5c72892d13ce

  • SHA1

    478c1f5c59b34131e2ada46956fa0b524a0646e1

  • SHA256

    269175619ab6161ea13a61bc860aaa06d274d8cac74c360d87e58e3b1f65e889

  • SHA512

    b45c5781d8dfeb3ba5e8cd96935154661b9035d734ca885e354fbf6abc25c8cc1b2f0d2b8bdc841e87b16ef91db1874d7e772fff1700eefa0cfdaabf482ed3b0

Malware Config

Extracted

Family

squirrelwaffle

C2

http://deanandwilconstruction.com/UXEvfuIlhws

http://arimeto.lv/Nm70oAfwB

http://gitamschool.com/oZbs0Oqw7uv

http://eresourcesmoneymarket.com/JbVwdgaV6l

http://flyershipmanager.com/SGAsORYsywt

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

  • Squirrelwaffle Payload 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\269175619ab6161ea13a61bc860aaa06d274d8cac74c360d87e58e3b1f65e889.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1312
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\269175619ab6161ea13a61bc860aaa06d274d8cac74c360d87e58e3b1f65e889.dll,#1
      2⤵
        PID:1572

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1572-54-0x0000000076911000-0x0000000076913000-memory.dmp

      Filesize

      8KB

    • memory/1572-55-0x0000000000180000-0x000000000019D000-memory.dmp

      Filesize

      116KB

    • memory/1572-56-0x0000000010000000-0x0000000010043000-memory.dmp

      Filesize

      268KB