Analysis

  • max time kernel
    154s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01-02-2022 04:38

General

  • Target

    a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392.exe

  • Size

    1.9MB

  • MD5

    c0befca5b32a78f917b5d54aa7ef823d

  • SHA1

    e867751ad701d02e7a265c1343cdfe632281c992

  • SHA256

    a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392

  • SHA512

    06df8ab58f0aa76410c85c5796d2638c9e74694ba0497d454ca9427b1a479b0c803cc9875aa2e13950d7718ee46a0b4bc40d7238ec20e5f0ff60da648c3bcee2

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.32:50045

31.44.184.32:50046

Attributes
  • service_name

    Enterprise Mailing Service

Signatures

  • SendSafe

    SendSafe is a notorious spam tool which then turned into spam botnet.

  • SendSafe Payload 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392.exe
    "C:\Users\Admin\AppData\Local\Temp\a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of UnmapMainImage
    PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/848-54-0x00000000751B1000-0x00000000751B3000-memory.dmp
    Filesize

    8KB

  • memory/848-55-0x0000000001E20000-0x0000000001FD2000-memory.dmp
    Filesize

    1.7MB

  • memory/848-56-0x0000000000400000-0x00000000005DE000-memory.dmp
    Filesize

    1.9MB