Analysis

  • max time kernel
    167s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    01-02-2022 04:38

General

  • Target

    a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392.exe

  • Size

    1.9MB

  • MD5

    c0befca5b32a78f917b5d54aa7ef823d

  • SHA1

    e867751ad701d02e7a265c1343cdfe632281c992

  • SHA256

    a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392

  • SHA512

    06df8ab58f0aa76410c85c5796d2638c9e74694ba0497d454ca9427b1a479b0c803cc9875aa2e13950d7718ee46a0b4bc40d7238ec20e5f0ff60da648c3bcee2

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.32:50045

31.44.184.32:50046

Attributes
  • service_name

    Enterprise Mailing Service

Signatures

  • SendSafe

    SendSafe is a notorious spam tool which then turned into spam botnet.

  • SendSafe Payload 1 IoCs
  • Sets service image path in registry 2 TTPs
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392.exe
    "C:\Users\Admin\AppData\Local\Temp\a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3408
  • C:\Windows\System32\WaaSMedicAgent.exe
    C:\Windows\System32\WaaSMedicAgent.exe cde834edf7dd3b2d75f45c6ee288276f mXXzQROENkiGuBKPD0WKJg.0.1.0.0.0
    1⤵
    • Modifies data under HKEY_USERS
    PID:456

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3408-130-0x00000000023C0000-0x0000000002572000-memory.dmp
    Filesize

    1.7MB

  • memory/3408-131-0x0000000000400000-0x00000000005DE000-memory.dmp
    Filesize

    1.9MB