sendsafe | 502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944

General

Target

502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
Size

943KB
MD5

8e048607275f42adff61e4adfee9df0c
SHA1

e371fddeb36b88381a7670a5fd32f6a0567d9124
SHA256

502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944
SHA512

0841226e5ed67a608047404b56f1ec97192bc446a06757b2bdc2c3bf9f7cfa3b9325bb9eb56cc81a30d289ce8624980ef752d1612a1ada53182575e404b1c00f

Score

10^/10

sendsafe unregistered botnet spam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

91.220.131.43:50003

91.220.131.43:50004

Attributes

service_name
Enterprise Mailing Service

Signatures

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe payload 5 IoCs

botnet

Processes:

resource	yara_rule
behavioral2/memory/2688-138-0x0000000000400000-0x00000000005C9000-memory.dmp	sendsafe
behavioral2/memory/2688-139-0x0000000000400000-0x00000000005C9000-memory.dmp	sendsafe
behavioral2/memory/2688-140-0x0000000000400000-0x00000000005C9000-memory.dmp	sendsafe
behavioral2/memory/2688-141-0x0000000000400000-0x00000000005C9000-memory.dmp	sendsafe
behavioral2/memory/2688-142-0x0000000000400000-0x00000000005C9000-memory.dmp	sendsafe

Loads dropped DLL 3 IoCs

Processes:

502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe

pid	process
788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe

description	pid	process	target process
PID 788 set thread context of 2688	788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe

pid	process
2688	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
2688	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe

description	pid	process	target process
PID 788 wrote to memory of 2688	788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
PID 788 wrote to memory of 2688	788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
PID 788 wrote to memory of 2688	788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
PID 788 wrote to memory of 2688	788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
PID 788 wrote to memory of 2688	788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
PID 788 wrote to memory of 2688	788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
PID 788 wrote to memory of 2688	788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
PID 788 wrote to memory of 2688	788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
PID 788 wrote to memory of 2688	788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
PID 788 wrote to memory of 2688	788	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe	502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe

C:\Users\Admin\AppData\Local\Temp\502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
"C:\Users\Admin\AppData\Local\Temp\502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:788

C:\Users\Admin\AppData\Local\Temp\502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe
"C:\Users\Admin\AppData\Local\Temp\502a0e685078b5c44fd566ea2f14c7f998fbb1d04f6527a5c289bc661e6b9944.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsrB26D.tmp\System.dll
Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
C:\Users\Admin\AppData\Roaming\SFhelper.dll
Filesize
54KB

MD5
742b299f76eeffe057a63574c295ce75

SHA1
b7ab39b8c0958885b55ff6ca4bce31d077445596

SHA256
887634e1ad732a47bb0823144957b18e5376dac6dc228c4e69c8bf1dc99de34a

SHA512
ad539f025dbd38fcb8dcc3ba8cb571a51fc7c94ef833ee1e4f980338e6f0ef9a3cada0cf8707b2cefaeee15ba35f35a75822f8c85e34052ce5ba44af3abbbef2

Download Submit
C:\Users\Admin\AppData\Roaming\SFhelper.dll
Filesize
54KB

MD5
742b299f76eeffe057a63574c295ce75

SHA1
b7ab39b8c0958885b55ff6ca4bce31d077445596

SHA256
887634e1ad732a47bb0823144957b18e5376dac6dc228c4e69c8bf1dc99de34a

SHA512
ad539f025dbd38fcb8dcc3ba8cb571a51fc7c94ef833ee1e4f980338e6f0ef9a3cada0cf8707b2cefaeee15ba35f35a75822f8c85e34052ce5ba44af3abbbef2

Download Submit
memory/788-136-0x00000000023D0000-0x00000000023E3000-memory.dmp

Filesize
76KB

Download
memory/2688-137-0x0000000000000000-mapping.dmp

Download
memory/2688-138-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/2688-139-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/2688-140-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/2688-141-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/2688-142-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads