sendsafe | 30f7a29fba235c8c7367269bd7f068ee53485310fd64a85eaf3d72cdbc3a1a22 | Triage

Analysis

max time kernel
4294213s
max time network
161s
platform
windows7_x64
resource
win7-20220310-en
submitted
20-03-2022 01:37

Sharing

Report Analysis Logs

General

Target

30f7a29fba235c8c7367269bd7f068ee53485310fd64a85eaf3d72cdbc3a1a22.exe
Size

1.9MB
MD5

8879989ba9060db98cb000c14c4c7f56
SHA1

92fd09ea63aedda4368fd74accec94c84b67b99c
SHA256

30f7a29fba235c8c7367269bd7f068ee53485310fd64a85eaf3d72cdbc3a1a22
SHA512

f3a5ecc046b147989eeee27993a46a75568fb55b62b618c9ecb942db5b9ea3a6f350335d25a89f286f785a8a87febfd90b61af82d4f042ad22ec3bcfbd566e25

Score

10^/10

sendsafe unregistered botnet spam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.67:50097

31.44.184.67:50098

Attributes

service_name
Enterprise Mailing Service

Signatures

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1064-56-0x0000000000400000-0x00000000005E3000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

30f7a29fba235c8c7367269bd7f068ee53485310fd64a85eaf3d72cdbc3a1a22.exe

pid process

1064 30f7a29fba235c8c7367269bd7f068ee53485310fd64a85eaf3d72cdbc3a1a22.exe

C:\Users\Admin\AppData\Local\Temp\30f7a29fba235c8c7367269bd7f068ee53485310fd64a85eaf3d72cdbc3a1a22.exe
"C:\Users\Admin\AppData\Local\Temp\30f7a29fba235c8c7367269bd7f068ee53485310fd64a85eaf3d72cdbc3a1a22.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-54-0x0000000075691000-0x0000000075693000-memory.dmp

Filesize
8KB

Download
memory/1064-55-0x00000000021C0000-0x0000000002372000-memory.dmp

Filesize
1.7MB

Download
memory/1064-56-0x0000000000400000-0x00000000005E3000-memory.dmp

Filesize
1.9MB

Download