Analysis

  • max time kernel
    149s
  • max time network
    134s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    05-10-2021 17:36

General

  • Target

    91.exe

  • Size

    1.9MB

  • MD5

    9dad67fe028767f4e59655475f4bda64

  • SHA1

    5dcd989ecb1575b825aa69087263ff596302e9f0

  • SHA256

    bfd33470ec8e9d4776742edd651fab67d230c5d13e3ba72beb14b5a89f151892

  • SHA512

    bed935f5216edf747a8d06b424ff0920ba6402ea3bd4f23e9adf874c067fd5e00d4f35b55750b4f57b8678a36e7c685ec475572cbe00289c10856618886b78c1

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.91:50065

31.44.184.91:50066

Attributes
  • service_name

    Enterprise Mailing Service

Signatures

  • SendSafe

    SendSafe is a notorious spam tool which then turned into spam botnet.

  • SendSafe Payload 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91.exe
    "C:\Users\Admin\AppData\Local\Temp\91.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3600-115-0x0000000002320000-0x00000000024D2000-memory.dmp
    Filesize

    1.7MB

  • memory/3600-116-0x0000000000400000-0x00000000005EA000-memory.dmp
    Filesize

    1.9MB