sendsafe | a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392 | Triage

Analysis

max time kernel
154s
max time network
154s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 04:38

Sharing

Report Analysis Logs

General

Target

a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392.exe
Size

1.9MB
MD5

c0befca5b32a78f917b5d54aa7ef823d
SHA1

e867751ad701d02e7a265c1343cdfe632281c992
SHA256

a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392
SHA512

06df8ab58f0aa76410c85c5796d2638c9e74694ba0497d454ca9427b1a479b0c803cc9875aa2e13950d7718ee46a0b4bc40d7238ec20e5f0ff60da648c3bcee2

Score

10^/10

sendsafe unregistered botnet spam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.32:50045

31.44.184.32:50046

Attributes

service_name
Enterprise Mailing Service

Signatures

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/848-56-0x0000000000400000-0x00000000005DE000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392.exe

pid process

848 a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392.exe

pid process

848 a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392.exe

C:\Users\Admin\AppData\Local\Temp\a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392.exe
"C:\Users\Admin\AppData\Local\Temp\a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-54-0x00000000751B1000-0x00000000751B3000-memory.dmp

Filesize
8KB

Download
memory/848-55-0x0000000001E20000-0x0000000001FD2000-memory.dmp

Filesize
1.7MB

Download
memory/848-56-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download