sendsafe | 6b9f4586110bd5bc342318e6e73a21fd288afd670be55d9807ba7ec5b89c379d | Triage

Analysis

max time kernel
150s
max time network
152s
platform
windows10_x64
resource
win10-en-20210920
submitted
05-10-2021 17:36

Sharing

Report Analysis Logs

General

Target

179.exe
Size

1.9MB
MD5

4806ae57cd7d3b3a538e36a99674dab9
SHA1

7c2f8324f05c80dc7de4226848b82b6a200e94ea
SHA256

6b9f4586110bd5bc342318e6e73a21fd288afd670be55d9807ba7ec5b89c379d
SHA512

8bfcee127ca030d434f1fad39aec9fc08e8266099c8dcba74099274dfc61339ca0c4473c209a63748ed138fda8d3e60920193d4a79d537ae1ef9206fb4f8f937

Score

10^/10

sendsafe unregistered botnet spam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.179:50065

31.44.184.179:50066

Attributes

service_name
Enterprise Mailing Service

Signatures

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2072-116-0x0000000000400000-0x00000000005EA000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

179.exe

pid process

2072 179.exe
2072 179.exe

C:\Users\Admin\AppData\Local\Temp\179.exe
"C:\Users\Admin\AppData\Local\Temp\179.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-115-0x00000000024E0000-0x0000000002692000-memory.dmp

Filesize
1.7MB

Download
memory/2072-116-0x0000000000400000-0x00000000005EA000-memory.dmp

Filesize
1.9MB

Download