sendsafe | 3b47a1a8d51b8b5963dc49026e72b236852007a135b6a21b764caed18ff88d40 | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 17:54

Sharing

Report Analysis Logs

General

Target

3b47a1a8d51b8b5963dc49026e72b236852007a135b6a21b764caed18ff88d40.exe
Size

2.1MB
MD5

0cca0a9832b372a44179ab77ab15d7ea
SHA1

750d71664ff8db04c77cbb9e5928ead7ad61635e
SHA256

3b47a1a8d51b8b5963dc49026e72b236852007a135b6a21b764caed18ff88d40
SHA512

d12b1580178b22b23badbf9654287799e656e6e418563b1df91be5c5067a9b4dd453495e66d867cbfffe9c1bcbda8a3edec6c054ac084b71a8f51143f0413ff3

Score

10^/10

sendsafe unregistered botnet spam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.82:50013

31.44.184.82:50014

Attributes

service_name
Enterprise Mailing Service

Signatures

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/644-56-0x0000000000400000-0x0000000000613000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

3b47a1a8d51b8b5963dc49026e72b236852007a135b6a21b764caed18ff88d40.exe

pid process

644 3b47a1a8d51b8b5963dc49026e72b236852007a135b6a21b764caed18ff88d40.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

3b47a1a8d51b8b5963dc49026e72b236852007a135b6a21b764caed18ff88d40.exe

pid process

644 3b47a1a8d51b8b5963dc49026e72b236852007a135b6a21b764caed18ff88d40.exe

C:\Users\Admin\AppData\Local\Temp\3b47a1a8d51b8b5963dc49026e72b236852007a135b6a21b764caed18ff88d40.exe
"C:\Users\Admin\AppData\Local\Temp\3b47a1a8d51b8b5963dc49026e72b236852007a135b6a21b764caed18ff88d40.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

Filesize
8KB

Download
memory/644-55-0x0000000002130000-0x00000000022E2000-memory.dmp

Filesize
1.7MB

Download
memory/644-56-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download