sendsafe | c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb

Analysis

max time kernel
176s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 03:20

Target

c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exe
Size

1.8MB
MD5

1801b59e8a960de092a3b8a875940a96
SHA1

59e7d03ba78a13c64eb482dbc347aa12184642e5
SHA256

c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb
SHA512

4bf44d36251f6774cf71f8791b00cf60329cc32ff58fdcba78641605283d1b3831a264751d0742e28b2045c366778f0e9b27fafaa630d346574850e3a7f8b979

Score

10^/10

Family

sendsafe

Botnet

UNREGISTERED

31.44.184.117:50017

31.44.184.117:50018

Attributes

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe payload 2 IoCs

botnet

Processes:

resource	yara_rule
behavioral2/memory/2168-131-0x0000000000400000-0x00000000005CD000-memory.dmp	sendsafe
behavioral2/memory/2168-132-0x0000000000400000-0x00000000005CD000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exe

pid	process
2168	c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exe
2168	c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exe

C:\Users\Admin\AppData\Local\Temp\c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exe
"C:\Users\Admin\AppData\Local\Temp\c6bd0d90ba534afe556afe109469c23d73d31ad563fe1629a6c0df2909ee97fb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2168

memory/2168-130-0x0000000002370000-0x0000000002522000-memory.dmp

Filesize
1.7MB

Download
memory/2168-131-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/2168-132-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download