sendsafe | 38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 07:28

Sharing

Report Analysis Logs

General

Target

38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d.exe
Size

1.8MB
MD5

954e5bfc83812346d1cd11a59f7d205d
SHA1

179dd32769c491758ff2e418c9b20efc94af5725
SHA256

38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d
SHA512

1d9eb7e3548e9082cccff9823ef7c205d9f161e35b66be22cc9737cfbf013781e56647fb54941945614310ba91f44904fe3341d03cb39779bbc41a1951503feb

Score

10^/10

sendsafe unregistered botnet spam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.32:50035

31.44.184.32:50036

Attributes

service_name
Enterprise Mailing Service

Signatures

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1964-57-0x0000000000400000-0x00000000005CA000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d.exe

pid process

1964 38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d.exe

pid process

1964 38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d.exe

C:\Users\Admin\AppData\Local\Temp\38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d.exe
"C:\Users\Admin\AppData\Local\Temp\38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-55-0x0000000074B21000-0x0000000074B23000-memory.dmp

Filesize
8KB

Download
memory/1964-56-0x0000000002010000-0x00000000021C2000-memory.dmp

Filesize
1.7MB

Download
memory/1964-57-0x0000000000400000-0x00000000005CA000-memory.dmp

Filesize
1.8MB

Download