sendsafe | c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18

Analysis

max time kernel
3s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 00:27

Target

c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18.exe
Size

1.8MB
MD5

190f316b77f0af5a1d353024d4c53c60
SHA1

5d771fe7270febebccc4dc668e9e76abf93b1566
SHA256

c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18
SHA512

c4fafd3924ab99c32946e7cdd5ae027d78e46a7016681da7b9e4be05efd693953ffce3ccb9a380d789495aa8845e0e413d2e53f3156ffed565906fe75c3f7cf3
SSDEEP

49152:tMAQOnlZOejwntDM5+ofv+XrdTwkV28r:s7ejyMQXX9

Score

10^/10

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral1/memory/1488-56-0x0000000001F70000-0x0000000002123000-memory.dmp	sendsafe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18.exe

description	pid	Process	procid_target
PID 1488 set thread context of 1960	1488	c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18.exe	27

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18.exe

description	pid	Process	procid_target
PID 1488 wrote to memory of 1960	1488	c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18.exe	27
PID 1488 wrote to memory of 1960	1488	c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18.exe	27
PID 1488 wrote to memory of 1960	1488	c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18.exe	27
PID 1488 wrote to memory of 1960	1488	c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18.exe	27
PID 1488 wrote to memory of 1960	1488	c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18.exe	27

C:\Users\Admin\AppData\Local\Temp\c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18.exe
"C:\Users\Admin\AppData\Local\Temp\c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18.exe
  "C:\Users\Admin\AppData\Local\Temp\c7c728104180c8113d62eb40e986d6ecef5faf68ea941e216041df3564550f18.exe"
  2⤵
  PID:1960

memory/1488-54-0x0000000001F70000-0x0000000002123000-memory.dmp

Filesize
1.7MB

Download
memory/1488-56-0x0000000001F70000-0x0000000002123000-memory.dmp

Filesize
1.7MB

Download
memory/1960-55-0x0000000000145951-mapping.dmp

Download