sendsafe | 1ed750c65754f8fa905f2e8a6f2dd864f910a2a7b68f080ca946efe22a28b0c4 | Triage

Analysis

max time kernel
187s
max time network
193s
platform
windows7_x64
resource
win7-20220414-en
submitted
16-05-2022 12:31

Sharing

Report Analysis Logs

General

Target

1ed750c65754f8fa905f2e8a6f2dd864f910a2a7b68f080ca946efe22a28b0c4.exe
Size

1.9MB
MD5

397149c43cba3dc36aa008e8e1e7b430
SHA1

866f579d72d2e817a0e31a1837673b687f0b447b
SHA256

1ed750c65754f8fa905f2e8a6f2dd864f910a2a7b68f080ca946efe22a28b0c4
SHA512

0c100e7153e8b59a12ada7ae48c61cbfb06def7b5f1c0413f70f26f59b040299ce42ba31cedc18b92227346fb3c40e3ccda8b78bf2dfedb31ec7f50853a4c938

Score

10^/10

sendsafe unregistered botnet spam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.106:50005

31.44.184.106:50006

Attributes

service_name
Enterprise Mailing Service

Signatures

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1764-56-0x0000000000400000-0x00000000005DD000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1ed750c65754f8fa905f2e8a6f2dd864f910a2a7b68f080ca946efe22a28b0c4.exe

pid process

1764 1ed750c65754f8fa905f2e8a6f2dd864f910a2a7b68f080ca946efe22a28b0c4.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

1ed750c65754f8fa905f2e8a6f2dd864f910a2a7b68f080ca946efe22a28b0c4.exe

pid process

1764 1ed750c65754f8fa905f2e8a6f2dd864f910a2a7b68f080ca946efe22a28b0c4.exe

C:\Users\Admin\AppData\Local\Temp\1ed750c65754f8fa905f2e8a6f2dd864f910a2a7b68f080ca946efe22a28b0c4.exe
"C:\Users\Admin\AppData\Local\Temp\1ed750c65754f8fa905f2e8a6f2dd864f910a2a7b68f080ca946efe22a28b0c4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

Filesize
8KB

Download
memory/1764-55-0x0000000002D00000-0x0000000002EB2000-memory.dmp

Filesize
1.7MB

Download
memory/1764-56-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download