Analysis

  • max time kernel
    4294213s
  • max time network
    161s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    20-03-2022 01:37

General

  • Target

    30f7a29fba235c8c7367269bd7f068ee53485310fd64a85eaf3d72cdbc3a1a22.exe

  • Size

    1.9MB

  • MD5

    8879989ba9060db98cb000c14c4c7f56

  • SHA1

    92fd09ea63aedda4368fd74accec94c84b67b99c

  • SHA256

    30f7a29fba235c8c7367269bd7f068ee53485310fd64a85eaf3d72cdbc3a1a22

  • SHA512

    f3a5ecc046b147989eeee27993a46a75568fb55b62b618c9ecb942db5b9ea3a6f350335d25a89f286f785a8a87febfd90b61af82d4f042ad22ec3bcfbd566e25

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.67:50097

31.44.184.67:50098

Attributes
  • service_name

    Enterprise Mailing Service

Signatures

  • SendSafe

    SendSafe is a notorious spam tool which then turned into spam botnet.

  • SendSafe Payload 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\30f7a29fba235c8c7367269bd7f068ee53485310fd64a85eaf3d72cdbc3a1a22.exe
    "C:\Users\Admin\AppData\Local\Temp\30f7a29fba235c8c7367269bd7f068ee53485310fd64a85eaf3d72cdbc3a1a22.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1064-54-0x0000000075691000-0x0000000075693000-memory.dmp
    Filesize

    8KB

  • memory/1064-55-0x00000000021C0000-0x0000000002372000-memory.dmp
    Filesize

    1.7MB

  • memory/1064-56-0x0000000000400000-0x00000000005E3000-memory.dmp
    Filesize

    1.9MB