Analysis
-
max time kernel
146s -
max time network
180s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 03:20
Static task
static1
Behavioral task
behavioral1
Sample
c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exe
Resource
win10v2004-20220721-en
General
-
Target
c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exe
-
Size
1.8MB
-
MD5
1801b59e8a960de092a3b8a875940a96
-
SHA1
59e7d03ba78a13c64eb482dbc347aa12184642e5
-
SHA256
c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb
-
SHA512
4bf44d36251f6774cf71f8791b00cf60329cc32ff58fdcba78641605283d1b3831a264751d0742e28b2045c366778f0e9b27fafaa630d346574850e3a7f8b979
Malware Config
Extracted
sendsafe
UNREGISTERED
31.44.184.117:50017
31.44.184.117:50018
-
service_name
Enterprise Mailing Service
Signatures
-
SendSafe payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1496-55-0x0000000000400000-0x00000000005CD000-memory.dmp sendsafe behavioral1/memory/1496-56-0x0000000000400000-0x00000000005CD000-memory.dmp sendsafe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exepid process 1496 c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exepid process 1496 c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exe"C:\Users\Admin\AppData\Local\Temp\c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage