Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25-06-2022 04:40

General

  • Target

    676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe

  • Size

    1.8MB

  • MD5

    3b06a29a97cc177e0ead020232757c49

  • SHA1

    f866cb89ead83d13ad49573ef4f2671c4caa967d

  • SHA256

    676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4

  • SHA512

    e4077465f6aeb45c23ba8bc17c076bb03459b1c9266aa9c813b63c6a5b553e349c7fbb38fadec54edd471cbec1f7e7f823ab0dafe759994bf120e0f454f061dd

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.32:50069

31.44.184.32:50070

Attributes
  • service_name

    Enterprise Mailing Service

Signatures

  • SendSafe

    SendSafe is a notorious spam tool which then turned into spam botnet.

  • SendSafe Payload 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe
    "C:\Users\Admin\AppData\Local\Temp\676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2632-130-0x0000000002500000-0x00000000026B2000-memory.dmp
    Filesize

    1.7MB

  • memory/2632-131-0x0000000000400000-0x00000000005D5000-memory.dmp
    Filesize

    1.8MB

  • memory/2632-132-0x0000000002500000-0x00000000026B2000-memory.dmp
    Filesize

    1.7MB

  • memory/2632-133-0x0000000000400000-0x00000000005D5000-memory.dmp
    Filesize

    1.8MB