Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-06-2022 19:51

General

  • Target

    1ed38d34149e4dab34c0fae63b684b8d307ed49323593258e6b12a12cdc7657f.exe

  • Size

    1.9MB

  • MD5

    9a566b4c059f8a656edbce5848794074

  • SHA1

    d62aac9fbcd40b39a6a64147dd63b314c15c1f18

  • SHA256

    1ed38d34149e4dab34c0fae63b684b8d307ed49323593258e6b12a12cdc7657f

  • SHA512

    72dcc2e510296f3ef8b3a72be10a4491a4a20024b71556b7ee1c8c3ae334c6ab405b67a105e9ad9ca8065470173f850d4cc8b15b6847217878ac8d2c38c5a918

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.140:50013

31.44.184.140:50014

Attributes
  • service_name

    Enterprise Mailing Service

Signatures

  • SendSafe

    SendSafe is a notorious spam tool which then turned into spam botnet.

  • SendSafe Payload 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ed38d34149e4dab34c0fae63b684b8d307ed49323593258e6b12a12cdc7657f.exe
    "C:\Users\Admin\AppData\Local\Temp\1ed38d34149e4dab34c0fae63b684b8d307ed49323593258e6b12a12cdc7657f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of UnmapMainImage
    PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1708-54-0x00000000758D1000-0x00000000758D3000-memory.dmp
    Filesize

    8KB

  • memory/1708-55-0x00000000020A0000-0x0000000002252000-memory.dmp
    Filesize

    1.7MB

  • memory/1708-56-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/1708-57-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB