Malware Analysis Report

2024-12-01 00:48

Sample ID 210116-6ekvg7re6a
Target vulcan.x64
SHA256 3668b167f5c9083a9738cfc4bd863a07379a5b02ee14f48a10fb1240f3e421a6
Tags
kaiten
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3668b167f5c9083a9738cfc4bd863a07379a5b02ee14f48a10fb1240f3e421a6

Threat Level: Known bad

The file vulcan.x64 was found to be: Known bad.

Malicious Activity Summary

kaiten

Identified Kaiten Bot

Kaiten family

Writes DNS configuration

Modifies hosts file

Reads CPU attributes

Reads runtime system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-01-16 14:50

Signatures

Identified Kaiten Bot

Description Indicator Process Target
N/A N/A N/A N/A

Kaiten family

kaiten

Analysis: behavioral1

Detonation Overview

Submitted

2021-01-16 14:50

Reported

2021-01-16 14:52

Platform

ubuntu-amd64

Max time kernel

5007s

Max time network

124s

Command Line

[./vulcan.x64]

Signatures

Modifies hosts file

Description Indicator Process Target
/etc/hosts /etc/hosts N/A N/A

Writes DNS configuration

Description Indicator Process Target
/etc/resolv.conf /etc/resolv.conf N/A N/A

Reads CPU attributes

Description Indicator Process Target
/sys/devices/system/cpu/online /sys/devices/system/cpu/online /usr/bin/uptime N/A
/sys/devices/system/cpu/online /sys/devices/system/cpu/online /usr/bin/w N/A

Reads runtime system information

Description Indicator Process Target
/proc/250/cmdline /proc/250/cmdline /usr/bin/w N/A
/proc/443/cmdline /proc/443/cmdline /usr/bin/w N/A
/proc/167/stat /proc/167/stat /usr/bin/w N/A
/proc/237/cmdline /proc/237/cmdline /usr/bin/w N/A
/proc/477/cmdline /proc/477/cmdline /usr/bin/w N/A
/proc/700/stat /proc/700/stat /usr/bin/w N/A
/proc/uptime /proc/uptime /usr/bin/w N/A
/proc/9/cmdline /proc/9/cmdline /usr/bin/w N/A
/proc/33/cmdline /proc/33/cmdline /usr/bin/w N/A
/proc/151/cmdline /proc/151/cmdline /usr/bin/w N/A
/proc/153/stat /proc/153/stat /usr/bin/w N/A
/proc/160/cmdline /proc/160/cmdline /usr/bin/w N/A
/proc/250/stat /proc/250/stat /usr/bin/w N/A
/proc/561/cmdline /proc/561/cmdline /usr/bin/w N/A
/proc/3/cmdline /proc/3/cmdline /usr/bin/w N/A
/proc/5/cmdline /proc/5/cmdline /usr/bin/w N/A
/proc/81/stat /proc/81/stat /usr/bin/w N/A
/proc/479/cmdline /proc/479/cmdline /usr/bin/w N/A
/proc/8/stat /proc/8/stat /usr/bin/w N/A
/proc/19/cmdline /proc/19/cmdline /usr/bin/w N/A
/proc/97/stat /proc/97/stat /usr/bin/w N/A
/proc/169/cmdline /proc/169/cmdline /usr/bin/w N/A
/proc/4/cmdline /proc/4/cmdline /usr/bin/w N/A
/proc/13/cmdline /proc/13/cmdline /usr/bin/w N/A
/proc/162/cmdline /proc/162/cmdline /usr/bin/w N/A
/proc/163/cmdline /proc/163/cmdline /usr/bin/w N/A
/proc/166/stat /proc/166/stat /usr/bin/w N/A
/proc/300/cmdline /proc/300/cmdline /usr/bin/w N/A
/proc/699/stat /proc/699/stat /usr/bin/w N/A
/proc/22/stat /proc/22/stat /usr/bin/w N/A
/proc/158/cmdline /proc/158/cmdline /usr/bin/w N/A
/proc/77/stat /proc/77/stat /usr/bin/w N/A
/proc/164/stat /proc/164/stat /usr/bin/w N/A
/proc/302/stat /proc/302/stat /usr/bin/w N/A
/proc/416/cmdline /proc/416/cmdline /usr/bin/w N/A
/proc/443/stat /proc/443/stat /usr/bin/w N/A
/proc/564/stat /proc/564/stat /usr/bin/w N/A
/proc/11/stat /proc/11/stat /usr/bin/w N/A
/proc/19/stat /proc/19/stat /usr/bin/w N/A
/proc/563/cmdline /proc/563/cmdline /usr/bin/w N/A
/proc/21/cmdline /proc/21/cmdline /usr/bin/w N/A
/proc/387/cmdline /proc/387/cmdline /usr/bin/w N/A
/proc/161/stat /proc/161/stat /usr/bin/w N/A
/proc/191/cmdline /proc/191/cmdline /usr/bin/w N/A
/proc/1/stat /proc/1/stat /usr/bin/w N/A
/proc/24/stat /proc/24/stat /usr/bin/w N/A
/proc/359/cmdline /proc/359/cmdline /usr/bin/w N/A
/proc/369/cmdline /proc/369/cmdline /usr/bin/w N/A
/proc/447/cmdline /proc/447/cmdline /usr/bin/w N/A
/proc/34/stat /proc/34/stat /usr/bin/w N/A
/proc/161/cmdline /proc/161/cmdline /usr/bin/w N/A
/proc/23/stat /proc/23/stat /usr/bin/w N/A
/proc/29/stat /proc/29/stat /usr/bin/w N/A
/proc/30/cmdline /proc/30/cmdline /usr/bin/w N/A
/proc/31/stat /proc/31/stat /usr/bin/w N/A
/proc/31/cmdline /proc/31/cmdline /usr/bin/w N/A
/proc/78/stat /proc/78/stat /usr/bin/w N/A
/proc/13/stat /proc/13/stat /usr/bin/w N/A
/proc/21/stat /proc/21/stat /usr/bin/w N/A
/proc/387/stat /proc/387/stat /usr/bin/w N/A
/proc/479/stat /proc/479/stat /usr/bin/w N/A
/proc/82/stat /proc/82/stat /usr/bin/w N/A
/proc/97/cmdline /proc/97/cmdline /usr/bin/w N/A
/proc/154/stat /proc/154/stat /usr/bin/w N/A
/proc/158/stat /proc/158/stat /usr/bin/w N/A
/proc/169/stat /proc/169/stat /usr/bin/w N/A
/proc/300/stat /proc/300/stat /usr/bin/w N/A
/proc/27/stat /proc/27/stat /usr/bin/w N/A
/proc/29/cmdline /proc/29/cmdline /usr/bin/w N/A
/proc/79/cmdline /proc/79/cmdline /usr/bin/w N/A
/proc/159/cmdline /proc/159/cmdline /usr/bin/w N/A
/proc/162/stat /proc/162/stat /usr/bin/w N/A
/proc/249/cmdline /proc/249/cmdline /usr/bin/w N/A
/proc/14/stat /proc/14/stat /usr/bin/w N/A
/proc/28/stat /proc/28/stat /usr/bin/w N/A
/proc/28/cmdline /proc/28/cmdline /usr/bin/w N/A
/proc/151/stat /proc/151/stat /usr/bin/w N/A
/proc/370/cmdline /proc/370/cmdline /usr/bin/w N/A
/proc/701/stat /proc/701/stat /usr/bin/w N/A
/proc/8/cmdline /proc/8/cmdline /usr/bin/w N/A
/proc/25/cmdline /proc/25/cmdline /usr/bin/w N/A
/proc/83/stat /proc/83/stat /usr/bin/w N/A
/proc/165/stat /proc/165/stat /usr/bin/w N/A
/proc/344/cmdline /proc/344/cmdline /usr/bin/w N/A
/proc/416/stat /proc/416/stat /usr/bin/w N/A
/proc/12/stat /proc/12/stat /usr/bin/w N/A
/proc/79/stat /proc/79/stat /usr/bin/w N/A
/proc/18/stat /proc/18/stat /usr/bin/w N/A
/proc/18/cmdline /proc/18/cmdline /usr/bin/w N/A
/proc/32/stat /proc/32/stat /usr/bin/w N/A
/proc/34/cmdline /proc/34/cmdline /usr/bin/w N/A
/proc/83/cmdline /proc/83/cmdline /usr/bin/w N/A
/proc/114/stat /proc/114/stat /usr/bin/w N/A
/proc/6/cmdline /proc/6/cmdline /usr/bin/w N/A
/proc/17/stat /proc/17/stat /usr/bin/w N/A
/proc/166/cmdline /proc/166/cmdline /usr/bin/w N/A
/proc/349/cmdline /proc/349/cmdline /usr/bin/w N/A
/proc/24/cmdline /proc/24/cmdline /usr/bin/w N/A
/proc/152/stat /proc/152/stat /usr/bin/w N/A
/proc/160/stat /proc/160/stat /usr/bin/w N/A
/proc/191/stat /proc/191/stat /usr/bin/w N/A
/proc/563/stat /proc/563/stat /usr/bin/w N/A
/proc/10/cmdline /proc/10/cmdline /usr/bin/w N/A
/proc/15/stat /proc/15/stat /usr/bin/w N/A
/proc/114/cmdline /proc/114/cmdline /usr/bin/w N/A
/proc/157/cmdline /proc/157/cmdline /usr/bin/w N/A
/proc/343/cmdline /proc/343/cmdline /usr/bin/w N/A
/proc/369/stat /proc/369/stat /usr/bin/w N/A
/proc/loadavg /proc/loadavg /usr/bin/w N/A
/proc/82/cmdline /proc/82/cmdline /usr/bin/w N/A
/proc/84/cmdline /proc/84/cmdline /usr/bin/w N/A
/proc/9/stat /proc/9/stat /usr/bin/w N/A
/proc/23/cmdline /proc/23/cmdline /usr/bin/w N/A
/proc/32/cmdline /proc/32/cmdline /usr/bin/w N/A
/proc/35/cmdline /proc/35/cmdline /usr/bin/w N/A
/proc/80/cmdline /proc/80/cmdline /usr/bin/w N/A
/proc/302/cmdline /proc/302/cmdline /usr/bin/w N/A
/proc/7/stat /proc/7/stat /usr/bin/w N/A
/proc/14/cmdline /proc/14/cmdline /usr/bin/w N/A
/proc/237/stat /proc/237/stat /usr/bin/w N/A
/proc/345/stat /proc/345/stat /usr/bin/w N/A
/proc/447/stat /proc/447/stat /usr/bin/w N/A
/proc/20/stat /proc/20/stat /usr/bin/w N/A
/proc/155/stat /proc/155/stat /usr/bin/w N/A
/proc/26/cmdline /proc/26/cmdline /usr/bin/w N/A
/proc/27/cmdline /proc/27/cmdline /usr/bin/w N/A
/proc/163/stat /proc/163/stat /usr/bin/w N/A
/proc/164/cmdline /proc/164/cmdline /usr/bin/w N/A
/proc/190/stat /proc/190/stat /usr/bin/w N/A
/proc/5/stat /proc/5/stat /usr/bin/w N/A
/proc/17/cmdline /proc/17/cmdline /usr/bin/w N/A
/proc/16/stat /proc/16/stat /usr/bin/w N/A
/proc/20/cmdline /proc/20/cmdline /usr/bin/w N/A
/proc/22/cmdline /proc/22/cmdline /usr/bin/w N/A
/proc/26/stat /proc/26/stat /usr/bin/w N/A
/proc/157/stat /proc/157/stat /usr/bin/w N/A
/proc/344/stat /proc/344/stat /usr/bin/w N/A
/proc/2/cmdline /proc/2/cmdline /usr/bin/w N/A
/proc/12/cmdline /proc/12/cmdline /usr/bin/w N/A
/proc/352/stat /proc/352/stat /usr/bin/w N/A
/proc/701/cmdline /proc/701/cmdline /usr/bin/w N/A
/proc/165/cmdline /proc/165/cmdline /usr/bin/w N/A
/proc/249/stat /proc/249/stat /usr/bin/w N/A
/proc/167/cmdline /proc/167/cmdline /usr/bin/w N/A
/proc/343/stat /proc/343/stat /usr/bin/w N/A
/proc/349/stat /proc/349/stat /usr/bin/w N/A
/proc/561/stat /proc/561/stat /usr/bin/w N/A
/proc/700/cmdline /proc/700/cmdline /usr/bin/w N/A
/proc/25/stat /proc/25/stat /usr/bin/w N/A
/proc/88/cmdline /proc/88/cmdline /usr/bin/w N/A
/proc/88/stat /proc/88/stat /usr/bin/w N/A
/proc/345/cmdline /proc/345/cmdline /usr/bin/w N/A
/proc/699/cmdline /proc/699/cmdline /usr/bin/w N/A
/proc/11/cmdline /proc/11/cmdline /usr/bin/w N/A
/proc/35/stat /proc/35/stat /usr/bin/w N/A
/proc/84/stat /proc/84/stat /usr/bin/w N/A
/proc/154/cmdline /proc/154/cmdline /usr/bin/w N/A
/proc/156/cmdline /proc/156/cmdline /usr/bin/w N/A
/proc/7/cmdline /proc/7/cmdline /usr/bin/w N/A
/proc/16/cmdline /proc/16/cmdline /usr/bin/w N/A
/proc/30/stat /proc/30/stat /usr/bin/w N/A
/proc/78/cmdline /proc/78/cmdline /usr/bin/w N/A
/proc/80/stat /proc/80/stat /usr/bin/w N/A
/proc/153/cmdline /proc/153/cmdline /usr/bin/w N/A
/proc/155/cmdline /proc/155/cmdline /usr/bin/w N/A
/proc/359/stat /proc/359/stat /usr/bin/w N/A
/proc/loadavg /proc/loadavg /usr/bin/uptime N/A
/proc/2/stat /proc/2/stat /usr/bin/w N/A
/proc/370/stat /proc/370/stat /usr/bin/w N/A
/proc/3/stat /proc/3/stat /usr/bin/w N/A
/proc/4/stat /proc/4/stat /usr/bin/w N/A
/proc/6/stat /proc/6/stat /usr/bin/w N/A
/proc/15/cmdline /proc/15/cmdline /usr/bin/w N/A
/proc/33/stat /proc/33/stat /usr/bin/w N/A
/proc/152/cmdline /proc/152/cmdline /usr/bin/w N/A
/proc/sys/kernel/osrelease /proc/sys/kernel/osrelease /usr/bin/uptime N/A
/proc/sys/kernel/osrelease /proc/sys/kernel/osrelease /usr/bin/w N/A
/proc/77/cmdline /proc/77/cmdline /usr/bin/w N/A
/proc/81/cmdline /proc/81/cmdline /usr/bin/w N/A
/proc/156/stat /proc/156/stat /usr/bin/w N/A
/proc/477/stat /proc/477/stat /usr/bin/w N/A
/proc/uptime /proc/uptime /usr/bin/uptime N/A
/proc/10/stat /proc/10/stat /usr/bin/w N/A
/proc/190/cmdline /proc/190/cmdline /usr/bin/w N/A
/proc/352/cmdline /proc/352/cmdline /usr/bin/w N/A
/proc/564/cmdline /proc/564/cmdline /usr/bin/w N/A
/proc/1/cmdline /proc/1/cmdline /usr/bin/w N/A
/proc/159/stat /proc/159/stat /usr/bin/w N/A

Processes

./vulcan.x64

[./vulcan.x64]

/bin/sh

[sh -c export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;uname -a;uptime]

/bin/uname

[uname -a]

/usr/bin/uptime

[uptime]

/bin/sh

[sh -c export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;w]

/usr/bin/w

[w]

Network

Country Destination Domain Proto
N/A 1.1.1.1:53 irc.n3twork30cm.ml udp
N/A 31.31.72.123:4445 irc.n3twork30cm.ml tcp
N/A 1.1.1.1:53 ntp.ubuntu.com udp
N/A 1.1.1.1:53 ntp.ubuntu.com udp
N/A 91.189.94.4:123 ntp.ubuntu.com udp
N/A 91.189.94.4:123 ntp.ubuntu.com udp
N/A 91.189.94.4:123 ntp.ubuntu.com udp

Files

N/A