squirrelwaffle | 22e427d636088505aed35304009c2ac23ae4f39784fa95d0d9d3ca12c71d3834

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-en-20211208
submitted
30-01-2022 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22e427d636088505aed35304009c2ac23ae4f39784fa95d0d9d3ca12c71d3834.dll
Size

221KB
MD5

841480e5194b30eea811a0f9e8c33caf
SHA1

77e0043bfd1556a181f4dc23269e85eaa7858f4a
SHA256

22e427d636088505aed35304009c2ac23ae4f39784fa95d0d9d3ca12c71d3834
SHA512

7669cb2f7da65a3dc1b182b239d734c08b82549473a13f7f4b4b215d38faf8afb5184583cc69143d245547f026982a4152309b9f644f29205dcb8b4a0ef21f82

Score

10^/10

squirrelwaffle downloader

Malware Config

Extracted

Family

squirrelwaffle

http://pop.vicamtaynam.com/VtyiHAft

http://snsvidyapeeth.in/aXmo2Dr3

http://trinitytesttubebaby.com/QR2JvfE3Sv

http://iconskw.com/cqdPtAbZ

http://ebookchuyennganh.com/v9PMvQDxHK8W

http://alsader.net/BHdQaiQ9rt

http://avyanshglobal.com/6pYjPlqf

http://primahills-online.com/ypCiZn7tMx

http://antoniocastroycia.com.co/WHe08obY

http://apexbiotech.net/VQgunQ4t5Ue

http://vscm.in/V3tYKxDz

http://sinaloworx.co.za/3GilA8Eo3r

http://dancongnghe.xyz/yRByhX6J3REI

http://trajesuniformes.com.br/qQofZMaJm

http://fiorenzapaes.com.br/PGYpETW7

http://astetinternational.com/arW5e44Y7vzO

http://razisystem.ir/MqvvkX0cWvn

http://krishnaiti.org.in/rWA02HQY4

Signatures

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle

Squirrelwaffle Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1860-56-0x0000000010000000-0x0000000014030000-memory.dmp	squirrelwaffle

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1860	1540	rundll32.exe	27
PID 1540 wrote to memory of 1860	1540	rundll32.exe	27
PID 1540 wrote to memory of 1860	1540	rundll32.exe	27
PID 1540 wrote to memory of 1860	1540	rundll32.exe	27
PID 1540 wrote to memory of 1860	1540	rundll32.exe	27
PID 1540 wrote to memory of 1860	1540	rundll32.exe	27
PID 1540 wrote to memory of 1860	1540	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22e427d636088505aed35304009c2ac23ae4f39784fa95d0d9d3ca12c71d3834.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22e427d636088505aed35304009c2ac23ae4f39784fa95d0d9d3ca12c71d3834.dll,#1
  2⤵
  PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/1860-55-0x0000000002010000-0x000000000602A000-memory.dmp

Filesize
64.1MB

Download
memory/1860-56-0x0000000010000000-0x0000000014030000-memory.dmp

Filesize
64.2MB

Download