664fd170b1d07e372b3daa91aab78a8151d3f0b0361a2b3157b405314dd219a2 | Triage

Resubmissions

20-04-2023 08:22

230420-j9jsfaae7s 10

27-03-2023 09:38

230327-lmbvescg32 10

Analysis

max time kernel
74s
max time network
39s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-04-2023 08:22

Sharing

Report Analysis Logs

General

Target

a07
Size

611KB
MD5

bcb6b83a4e6e20ffe0ce3c750360ddf5
SHA1

d88755b78834e87418aa3cb3bfee5de5c378bd2f
SHA256

61b0107a7a06ecbb8cc1d323967291d15450df7e8bab5d96c822a98c9399a521
SHA512

f3be44f45eb0c453192b0ddeb7d37f3335499b41b46cc3190e918ac2909f048b3857d2496ebd33fa79ddce4024a1b47a5e44867ff576c18eb998c7e4f87914ca
SSDEEP

12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6TiZx6yB1/iGK4UlUuTh1AG:UB1BVpmExDYp38X8LYTWhZfNiGQl/91h

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 3 IoCs

Hijack Execution Flow

description	ioc
/bin/aduolnwzmz	/bin/aduolnwzmz
/bin/fpeujtrrxb	/bin/fpeujtrrxb
/bin/tugqxcvpkx	/bin/tugqxcvpkx

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Scheduled Task

description	ioc	Process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

Boot or Logon Autostart Execution

description	ioc
/etc/init.d/��,��,��	/etc/init.d/��,��,��

Modifies rc script 1 TTPs 17 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

Boot or Logon Autostart Execution

description	ioc	Process
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc3.d/S90��,��,��	/etc/rc3.d/S90��,��,��	Process not Found
/etc/rc5.d/S90��,��,��	/etc/rc5.d/S90��,��,��	Process not Found
/etc/rc2.d/S90a07	/etc/rc2.d/S90a07	Process not Found
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc4.d/S90��,��,��	/etc/rc4.d/S90��,��,��	Process not Found
/etc/rc3.d/S90a07	/etc/rc3.d/S90a07	Process not Found
/etc/rc5.d/S90a07	/etc/rc5.d/S90a07	Process not Found
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d
/etc/rc1.d/S90a07	/etc/rc1.d/S90a07	Process not Found
/etc/rc4.d/S90a07	/etc/rc4.d/S90a07	Process not Found
/etc/rc1.d/S90��,��,��	/etc/rc1.d/S90��,��,��	Process not Found
/etc/rc2.d/S90��,��,��	/etc/rc2.d/S90��,��,��	Process not Found

Write file to user bin folder 1 TTPs 6 IoCs

Hijack Execution Flow

description	ioc	Process
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d
/usr/bin/aduolnwzmz	/usr/bin/aduolnwzmz	Process not Found
/usr/bin/iaoqibhcap	/usr/bin/iaoqibhcap	Process not Found
/usr/bin/fpeujtrrxb	/usr/bin/fpeujtrrxb	Process not Found
/usr/bin/tugqxcvpkx	/usr/bin/tugqxcvpkx	Process not Found
/usr/bin/dwfioylnsy	/usr/bin/dwfioylnsy	Process not Found

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
/tmp/aduolnwzmz	/tmp/aduolnwzmz
/tmp/fpeujtrrxb	/tmp/fpeujtrrxb
/tmp/tugqxcvpkx	/tmp/tugqxcvpkx

/tmp/a07
/tmp/a07
1⤵
PID:609

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:615
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:616

/bin/chkconfig
chkconfig --add a07
1⤵
PID:612

/sbin/chkconfig
chkconfig --add a07
1⤵
PID:612

/usr/bin/chkconfig
chkconfig --add a07
1⤵
PID:612

/usr/sbin/chkconfig
chkconfig --add a07
1⤵
PID:612

/usr/local/bin/chkconfig
chkconfig --add a07
1⤵
PID:612

/usr/local/sbin/chkconfig
chkconfig --add a07
1⤵
PID:612

/usr/X11R6/bin/chkconfig
chkconfig --add a07
1⤵
PID:612

/bin/update-rc.d
update-rc.d a07 defaults
1⤵
PID:614

/sbin/update-rc.d
update-rc.d a07 defaults
1⤵
PID:614

/usr/bin/update-rc.d
update-rc.d a07 defaults
1⤵
PID:614

/usr/sbin/update-rc.d
update-rc.d a07 defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:614
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:618

/usr/bin/aduolnwzmz
/usr/bin/aduolnwzmz "route -n" 610
1⤵
PID:641

/usr/bin/aduolnwzmz
/usr/bin/aduolnwzmz bash 610
1⤵
PID:644

/usr/bin/aduolnwzmz
/usr/bin/aduolnwzmz ifconfig 610
1⤵
PID:647

/usr/bin/aduolnwzmz
/usr/bin/aduolnwzmz ifconfig 610
1⤵
PID:650

/usr/bin/aduolnwzmz
/usr/bin/aduolnwzmz uptime 610
1⤵
PID:653

/usr/bin/iaoqibhcap
/usr/bin/iaoqibhcap "grep \"A\"" 610
1⤵
PID:656

/usr/bin/iaoqibhcap
/usr/bin/iaoqibhcap "ls -la" 610
1⤵
PID:659

/usr/bin/iaoqibhcap
/usr/bin/iaoqibhcap ifconfig 610
1⤵
PID:662

/usr/bin/iaoqibhcap
/usr/bin/iaoqibhcap "cd /etc" 610
1⤵
PID:665

/usr/bin/iaoqibhcap
/usr/bin/iaoqibhcap ls 610
1⤵
PID:668

/usr/bin/fpeujtrrxb
/usr/bin/fpeujtrrxb "echo \"find\"" 610
1⤵
PID:674

/usr/bin/fpeujtrrxb
/usr/bin/fpeujtrrxb "cat resolv.conf" 610
1⤵
PID:677

/usr/bin/fpeujtrrxb
/usr/bin/fpeujtrrxb "cat resolv.conf" 610
1⤵
PID:680

/usr/bin/fpeujtrrxb
/usr/bin/fpeujtrrxb "ps -ef" 610
1⤵
PID:683

/usr/bin/tugqxcvpkx
/usr/bin/tugqxcvpkx pwd 610
1⤵
PID:686

/usr/bin/tugqxcvpkx
/usr/bin/tugqxcvpkx ifconfig 610
1⤵
PID:689

/usr/bin/tugqxcvpkx
/usr/bin/tugqxcvpkx gnome-terminal 610
1⤵
PID:692

/usr/bin/tugqxcvpkx
/usr/bin/tugqxcvpkx ifconfig 610
1⤵
PID:695

/usr/bin/tugqxcvpkx
/usr/bin/tugqxcvpkx top 610
1⤵
PID:698

/usr/bin/icqhpcrxcn
/usr/bin/icqhpcrxcn sh 610
1⤵
PID:718

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task

Defense Evasion

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads