Overview

overview

10

Static

static

w32.dll

windows10_x64

10

Analysis

  • max time kernel
    289s
  • max time network
    291s
  • platform
    windows10_x64
  • resource
    win10-20220223-en
  • submitted
    01-03-2022 22:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    w32.dll

  • Size

    274KB

  • MD5

    23660c8770384de8808d482630f6617c

  • SHA1

    55d3d2226a8af0b6cfcfbe8d590cd880954ca419

  • SHA256

    00d045c89934c776a70318a36655dcdd77e1fedae0d33c98e301723f323f234c

  • SHA512

    8f489cbf44d77394fcd25d0f4f9d178e13b317489468951a144d84a9e45508492647158ec9dfada6815eb2770e55aa9f6746516b86df1e155ef84a6d4b255eb2

Score
10/10
squirrelwaffledownloadersuricata

Malware Config

Extracted

Family

squirrelwaffle

C2

http://celulasmadreenmexico.com.mx/Wt793Aua

http://gerencial.institutoacqua.org.br/XynFkhJAxnm

http://dashboard.adlytic.ai/LlvLoc9O3

http://bussiness-z.ml/3pdEiqsni

http://ifiengineers.com/hGVc55g2e

http://bonusvulkanvegas.srdm.in/U7oOxmI1m

http://ebrouteindia.com/JEqGe1hNR

http://test.dirigu.ro/dXf4cS4GPL

http://cablingpoint.com/LjDG0hkp

http://perfectdemos.com/T6PQGYCMt

http://afrizam.360cyberlink.com/f36rjSN5D1

http://giasuphire.tddvn.com/miFO43YP9b

http://priyacareers.com/GiTHMPbU

http://assurant.360cyberlink.com/DGx4k8U9Hil

http://sig.institutoacqua.org.br/tM7tINg2sCU
Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Signatures

  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

    downloadersquirrelwaffle
  • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    suricata
  • Squirrelwaffle Payload 2 IoCs
  • Blocklisted process makes network request 11 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\w32.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\w32.dll,#1
      2⤵
      • Blocklisted process makes network request
      PID:3704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3704-114-0x0000000074310000-0x000000007435F000-memory.dmp

    Filesize

    316KB

    Download

  • memory/3704-115-0x0000000074310000-0x0000000074322000-memory.dmp

    Filesize

    72KB

    Download

  • memory/3704-116-0x0000000074310000-0x000000007435F000-memory.dmp

    Filesize

    316KB

    Download

  • memory/3704-117-0x000000007434F000-0x0000000074355000-memory.dmp

    Filesize

    24KB

    Download

  • memory/3704-118-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

    Filesize

    4KB

    Download