Analysis

  • max time kernel
    159s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    01-02-2022 07:28

General

  • Target

    38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d.exe

  • Size

    1.8MB

  • MD5

    954e5bfc83812346d1cd11a59f7d205d

  • SHA1

    179dd32769c491758ff2e418c9b20efc94af5725

  • SHA256

    38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d

  • SHA512

    1d9eb7e3548e9082cccff9823ef7c205d9f161e35b66be22cc9737cfbf013781e56647fb54941945614310ba91f44904fe3341d03cb39779bbc41a1951503feb

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.32:50035

31.44.184.32:50036

Attributes
  • service_name

    Enterprise Mailing Service

Signatures

  • SendSafe

    SendSafe is a notorious spam tool which then turned into spam botnet.

  • SendSafe Payload 1 IoCs
  • Sets service image path in registry 2 TTPs
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d.exe
    "C:\Users\Admin\AppData\Local\Temp\38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3984
  • C:\Windows\System32\WaaSMedicAgent.exe
    C:\Windows\System32\WaaSMedicAgent.exe 158222b87dce39cce6a678a5047f886d O/t/vqmvr0W6dqZWOuA7UQ.0.1.0.0.0
    1⤵
    • Modifies data under HKEY_USERS
    PID:536

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3984-130-0x0000000002590000-0x0000000002742000-memory.dmp
    Filesize

    1.7MB

  • memory/3984-131-0x0000000000400000-0x00000000005CA000-memory.dmp
    Filesize

    1.8MB