sendsafe | 9a58ba68212ccfc1679461328b83bf6674bcc6a310d70f40ac62133dc1e34f9d | Triage

Analysis

max time kernel
150s
max time network
151s
platform
windows10_x64
resource
win10-en-20210920
submitted
29-09-2021 14:17

Sharing

Report Analysis Logs

General

Target

91.exe
Size

1.9MB
MD5

b8f94c85cd5d1c37e884b016f3266586
SHA1

8f51937fdb353334cd457800c99d859dd4562cb0
SHA256

9a58ba68212ccfc1679461328b83bf6674bcc6a310d70f40ac62133dc1e34f9d
SHA512

15eefe7cd210826e2d2ef349ee92282838c7fbe5dca37c0fcf6d592d42163847afec4533853214a8aaf7bc930b9b451a1bf10fc00b403abd810c21a24ffd371c

Score

10^/10

sendsafe unregistered botnet spam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.91:50063

31.44.184.91:50064

Attributes

service_name
Enterprise Mailing Service

Signatures

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

sendsafe 1 IoCs

SendSafe Payload

Processes:

resource	yara_rule
behavioral2/memory/2160-116-0x0000000000400000-0x00000000005EA000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

91.exe

pid process

2160 91.exe
2160 91.exe

C:\Users\Admin\AppData\Local\Temp\91.exe
"C:\Users\Admin\AppData\Local\Temp\91.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2160-115-0x0000000002330000-0x00000000024E2000-memory.dmp

Filesize
1.7MB

Download
memory/2160-116-0x0000000000400000-0x00000000005EA000-memory.dmp

Filesize
1.9MB

Download