squirrelwaffle | 221a2953b14095e0906bad6c1c7e39362278035c13be6c8b5a025c1cf128f28f

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
30-01-2022 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

221a2953b14095e0906bad6c1c7e39362278035c13be6c8b5a025c1cf128f28f.dll
Size

333KB
MD5

737195d3ce34117555860d83ffc160b9
SHA1

bc230609bd3fa6b52481acfc45a69697ed08add2
SHA256

221a2953b14095e0906bad6c1c7e39362278035c13be6c8b5a025c1cf128f28f
SHA512

f12a6c35d2abdf0f8cde737bece2a82ad4cab575d776ca99c1e3d8983158c486638e47de7af4491d7343dfb02a014a35c2b812ac56601717f20f1a813e2a5cc4

Score

10^/10

squirrelwaffle downloader

Malware Config

Extracted

Family

squirrelwaffle

http://atertreat.in/5iPPVRKPPX9

http://incentivaconsultores.com.co/55jHpKCc9DWy

http://cdelean.org/0qvbbmu9g

http://bazy.ps/M6SjrMSYC

http://sukmabali.com/ZXxcLYs3rzRQ

http://bugwilliam.tk/cbB56YrugdbW

http://bestbeatsgh.com/42D7OwuPen

http://krumaila.com/UZ4NdDoDh4Tu

http://razehub.com/NN70nExbtLO

http://arcb.ro/aHUUNxE3Me5

http://cfmi.tg/m40YS6gDO0

http://sweetlittle.mx/ZCXP0dT2h

http://alkimia-prod.com/nT0imyzmo

http://almexperts.co.za/fEoJ3pdWZbF

Signatures

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle

Squirrelwaffle Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1084-56-0x0000000010000000-0x000000001004D000-memory.dmp	squirrelwaffle

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1084	1876	rundll32.exe	27
PID 1876 wrote to memory of 1084	1876	rundll32.exe	27
PID 1876 wrote to memory of 1084	1876	rundll32.exe	27
PID 1876 wrote to memory of 1084	1876	rundll32.exe	27
PID 1876 wrote to memory of 1084	1876	rundll32.exe	27
PID 1876 wrote to memory of 1084	1876	rundll32.exe	27
PID 1876 wrote to memory of 1084	1876	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\221a2953b14095e0906bad6c1c7e39362278035c13be6c8b5a025c1cf128f28f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\221a2953b14095e0906bad6c1c7e39362278035c13be6c8b5a025c1cf128f28f.dll,#1
  2⤵
  PID:1084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1084-55-0x0000000000100000-0x0000000000123000-memory.dmp

Filesize
140KB

Download
memory/1084-56-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download