sendsafe | 6c63c5d6c9a23a169eaa79e96c11fc62d685f2f572c602b1bca42376225cec6d

Analysis

max time kernel
186s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 12:58

Target

6c63c5d6c9a23a169eaa79e96c11fc62d685f2f572c602b1bca42376225cec6d.exe
Size

1.8MB
MD5

e202b6d424f6d0a58b74b7eb3a71653d
SHA1

f6ff3c60c3f00fe0b7f92ebbe9922df85e7bf489
SHA256

6c63c5d6c9a23a169eaa79e96c11fc62d685f2f572c602b1bca42376225cec6d
SHA512

867d27dd97edc7f8578e52ccefd05ecf00c67cd6e3dfdba5934538db53d789128c715d17dd7e7bf6a3115fd94ee92202058a905b0f958213bdeb9f79f53659e6
SSDEEP

49152:qoWrHHJeSUtbtMCiwwxi53lkH4R7+RiiKUE0HcL1MLqz:4rHMSUECiizkYARBlE0HQua

Score

10^/10

Family

sendsafe

Botnet

UNREGISTERED

31.44.184.55:50029

31.44.184.55:50030

Attributes

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral2/memory/1444-133-0x0000000000400000-0x00000000005CF000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6c63c5d6c9a23a169eaa79e96c11fc62d685f2f572c602b1bca42376225cec6d.exe

pid	process
1444	6c63c5d6c9a23a169eaa79e96c11fc62d685f2f572c602b1bca42376225cec6d.exe
1444	6c63c5d6c9a23a169eaa79e96c11fc62d685f2f572c602b1bca42376225cec6d.exe

C:\Users\Admin\AppData\Local\Temp\6c63c5d6c9a23a169eaa79e96c11fc62d685f2f572c602b1bca42376225cec6d.exe
"C:\Users\Admin\AppData\Local\Temp\6c63c5d6c9a23a169eaa79e96c11fc62d685f2f572c602b1bca42376225cec6d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1444

memory/1444-132-0x0000000002400000-0x00000000025B2000-memory.dmp

Filesize
1.7MB

Download
memory/1444-133-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download