Overview

overview

10

Static

static

2462d5526b...2c.exe

windows7_x64

10

2462d5526b...2c.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    163s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    11-06-2022 22:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2462d5526bf60986a139f7dba41606a4bafd574431f31c38048d573a1ca3f52c.exe

  • Size

    1.9MB

  • MD5

    8d771bb22bcb38f1c7b47e13678d36b1

  • SHA1

    46e428de1757248bad10aa79ea86c18f360475c3

  • SHA256

    2462d5526bf60986a139f7dba41606a4bafd574431f31c38048d573a1ca3f52c

  • SHA512

    ada911d8a3fd31590d8740c20d68f926558839d2ef3ea52782f43deaf881ebfd67c986f5d7962afb76da1fdbd3a29133f55f35bb8ae43baed1c07362aa533ffb

Score
10/10
sendsafeunregisteredbotnetspam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.32:50013

31.44.184.32:50014
Attributes
  • service_name

    Enterprise Mailing Service

Signatures

  • SendSafe

    SendSafe is a notorious spam tool which then turned into spam botnet.

    spambotnetsendsafe
  • SendSafe Payload 2 IoCs
    botnet
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2462d5526bf60986a139f7dba41606a4bafd574431f31c38048d573a1ca3f52c.exe
    "C:\Users\Admin\AppData\Local\Temp\2462d5526bf60986a139f7dba41606a4bafd574431f31c38048d573a1ca3f52c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1208-130-0x0000000002840000-0x00000000029F2000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/1208-131-0x0000000000400000-0x00000000005F0000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1208-132-0x0000000002840000-0x00000000029F2000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/1208-133-0x0000000000400000-0x00000000005F0000-memory.dmp
    Filesize

    1.9MB

    Download