sendsafe | 30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8 | Triage

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20220414-en
submitted
21-06-2022 15:19

Sharing

Report Analysis Logs

General

Target

30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8.exe
Size

2.1MB
MD5

686baf9e0dd47eac47e6f994a83412a7
SHA1

1b3c61d9a6194f956654713532fb39a8abdd5495
SHA256

30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8
SHA512

437eae8f0c0006cf87df55f7915571ec463e9ea7a9e00c5849b8ad0b041b6d7789fb1c3b9cdfab4db693517015f3e76cc296414870c5dab22612108554adfb03

Score

10^/10

sendsafe unregistered botnet spam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.32:50003

31.44.184.32:50004

Attributes

service_name
Enterprise Mailing Service

Signatures

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1956-56-0x0000000000400000-0x0000000000619000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8.exe

pid process

1956 30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8.exe

pid process

1956 30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8.exe

C:\Users\Admin\AppData\Local\Temp\30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8.exe
"C:\Users\Admin\AppData\Local\Temp\30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-54-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download
memory/1956-55-0x00000000020E0000-0x0000000002292000-memory.dmp

Filesize
1.7MB

Download
memory/1956-56-0x0000000000400000-0x0000000000619000-memory.dmp

Filesize
2.1MB

Download
memory/1956-57-0x00000000020E0000-0x0000000002292000-memory.dmp

Filesize
1.7MB

Download