664fd170b1d07e372b3daa91aab78a8151d3f0b0361a2b3157b405314dd219a2 | Triage

Resubmissions

20-04-2023 08:22

230420-j9jsfaae7s 10

27-03-2023 09:38

230327-lmbvescg32 10

Analysis

max time kernel
0s
max time network
102s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
27-03-2023 09:38

Sharing

Report Analysis Logs

General

Target

a09
Size

611KB
MD5

d1b5b4b4b5a118e384c7ff487e14ac3f
SHA1

038b7e9406fe5cb0a0be8f95ac935923c6d83c28
SHA256

0a312a4154dcec2bc6ce1d3b51c037b122ace5848ec99c2b861ab6124addae9b
SHA512

20885f782beeca1712924d6dec7fa474fb2fa7f926d7cbdbdd5f7fa18f6a3ac2bcd5dbd771a80c13c3403cbad05f2cda86ffefdc8170d6cc0f0b4b01a5baec74
SSDEEP

12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6TiLx6yB1/iGK4UlUuTh1AG:UB1BVpmExDYp38X8LYTWhLfNiGQl/91h

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 5 IoCs

Hijack Execution Flow

Processes:

description	ioc
/bin/iezwpzmkzb	/bin/iezwpzmkzb
/bin/feryyocwif	/bin/feryyocwif
/bin/qcbebanzfj	/bin/qcbebanzfj
/bin/mzdzgstrpc	/bin/mzdzgstrpc
/bin/zflducmkmh	/bin/zflducmkmh

Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task
T1053

Processes:

sedsh

description ioc process

/etc/crontab /etc/crontab sed
/etc/crontab /etc/crontab sh

Modifies rc script 1 TTPs 12 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

Boot or Logon Autostart Execution

Processes:

update-rc.d

description	ioc
/etc/rc1.d/S90a09	/etc/rc1.d/S90a09
/etc/rc2.d/S90a09	/etc/rc2.d/S90a09
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d
/etc/rc3.d/S90a09	/etc/rc3.d/S90a09
/etc/rc4.d/S90a09	/etc/rc4.d/S90a09
/etc/rc5.d/S90a09	/etc/rc5.d/S90a09
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d

Write file to user bin folder 1 TTPs 7 IoCs

Hijack Execution Flow

Processes:

update-rc.d

description	ioc
/usr/bin/zflducmkmh	/usr/bin/zflducmkmh
/usr/bin/jvuojfgvmi	/usr/bin/jvuojfgvmi
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d
/usr/bin/iezwpzmkzb	/usr/bin/iezwpzmkzb
/usr/bin/feryyocwif	/usr/bin/feryyocwif
/usr/bin/qcbebanzfj	/usr/bin/qcbebanzfj
/usr/bin/mzdzgstrpc	/usr/bin/mzdzgstrpc

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

Processes:

systemctlsed

description	ioc	process
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	systemctl

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

Processes:

description	ioc
/tmp/iezwpzmkzb	/tmp/iezwpzmkzb
/tmp/feryyocwif	/tmp/feryyocwif
/tmp/qcbebanzfj	/tmp/qcbebanzfj
/tmp/mzdzgstrpc	/tmp/mzdzgstrpc
/tmp/zflducmkmh	/tmp/zflducmkmh

/tmp/a09
/tmp/a09
1⤵
PID:607

/bin/chkconfig
chkconfig --add a09
1⤵
PID:610

/sbin/chkconfig
chkconfig --add a09
1⤵
PID:610

/usr/bin/chkconfig
chkconfig --add a09
1⤵
PID:610

/usr/sbin/chkconfig
chkconfig --add a09
1⤵
PID:610

/usr/local/bin/chkconfig
chkconfig --add a09
1⤵
PID:610

/usr/local/sbin/chkconfig
chkconfig --add a09
1⤵
PID:610

/usr/X11R6/bin/chkconfig
chkconfig --add a09
1⤵
PID:610

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:613

/bin/sed
sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
2⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:614

/bin/update-rc.d
update-rc.d a09 defaults
1⤵
PID:612

/sbin/update-rc.d
update-rc.d a09 defaults
1⤵
PID:612

/usr/bin/update-rc.d
update-rc.d a09 defaults
1⤵
PID:612

/usr/sbin/update-rc.d
update-rc.d a09 defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:612

/bin/systemctl
systemctl daemon-reload
2⤵
- Reads runtime system information
PID:616

/usr/bin/iezwpzmkzb
/usr/bin/iezwpzmkzb uptime 608
1⤵
PID:638

/usr/bin/iezwpzmkzb
/usr/bin/iezwpzmkzb ifconfig 608
1⤵
PID:642

/usr/bin/iezwpzmkzb
/usr/bin/iezwpzmkzb ls 608
1⤵
PID:645

/usr/bin/iezwpzmkzb
/usr/bin/iezwpzmkzb "echo \"find\"" 608
1⤵
PID:648

/usr/bin/iezwpzmkzb
/usr/bin/iezwpzmkzb "netstat -antop" 608
1⤵
PID:651

/usr/bin/feryyocwif
/usr/bin/feryyocwif id 608
1⤵
PID:654

/usr/bin/feryyocwif
/usr/bin/feryyocwif gnome-terminal 608
1⤵
PID:657

/usr/bin/feryyocwif
/usr/bin/feryyocwif "ps -ef" 608
1⤵
PID:660

/usr/bin/feryyocwif
/usr/bin/feryyocwif id 608
1⤵
PID:663

/usr/bin/feryyocwif
/usr/bin/feryyocwif "grep \"A\"" 608
1⤵
PID:666

/usr/bin/qcbebanzfj
/usr/bin/qcbebanzfj who 608
1⤵
PID:669

/usr/bin/qcbebanzfj
/usr/bin/qcbebanzfj "ifconfig eth0" 608
1⤵
PID:672

/usr/bin/qcbebanzfj
/usr/bin/qcbebanzfj "grep \"A\"" 608
1⤵
PID:675

/usr/bin/qcbebanzfj
/usr/bin/qcbebanzfj id 608
1⤵
PID:678

/usr/bin/qcbebanzfj
/usr/bin/qcbebanzfj uptime 608
1⤵
PID:681

/usr/bin/mzdzgstrpc
/usr/bin/mzdzgstrpc su 608
1⤵
PID:684

/usr/bin/mzdzgstrpc
/usr/bin/mzdzgstrpc "netstat -an" 608
1⤵
PID:687

/usr/bin/mzdzgstrpc
/usr/bin/mzdzgstrpc who 608
1⤵
PID:690

/usr/bin/mzdzgstrpc
/usr/bin/mzdzgstrpc top 608
1⤵
PID:693

/usr/bin/mzdzgstrpc
/usr/bin/mzdzgstrpc "grep \"A\"" 608
1⤵
PID:696

/usr/bin/zflducmkmh
/usr/bin/zflducmkmh gnome-terminal 608
1⤵
PID:699

/usr/bin/zflducmkmh
/usr/bin/zflducmkmh ifconfig 608
1⤵
PID:702

/usr/bin/zflducmkmh
/usr/bin/zflducmkmh "echo \"find\"" 608
1⤵
PID:705

/usr/bin/zflducmkmh
/usr/bin/zflducmkmh "ifconfig eth0" 608
1⤵
PID:708

/usr/bin/zflducmkmh
/usr/bin/zflducmkmh ls 608
1⤵
PID:711

/usr/bin/jvuojfgvmi
/usr/bin/jvuojfgvmi id 608
1⤵
PID:714

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Hijack Execution Flow

Scheduled Task

Boot or Logon Autostart Execution

Privilege Escalation

Hijack Execution Flow

Scheduled Task

Boot or Logon Autostart Execution

Defense Evasion

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...