664fd170b1d07e372b3daa91aab78a8151d3f0b0361a2b3157b405314dd219a2 | Triage

Resubmissions

20-04-2023 08:22

230420-j9jsfaae7s 10

27-03-2023 09:38

230327-lmbvescg32 10

Analysis

max time kernel
61s
max time network
39s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-04-2023 08:22

Sharing

Report Analysis Logs

General

Target

a08
Size

611KB
MD5

a99c10cb9713770b9e7dda376cddee3a
SHA1

1f1dd4d74eba8949fb1d2316c13f77b3ffa96f98
SHA256

92a260d856e00056469fb26f5305a37f6ab443d735d1476281b053b10b3c4f86
SHA512

1d410a7259469a16a1599fb28cb7cd82813270a112055e4fbe28327735a2968affbfdcba0a2001d504919e5ef3b271f40c45da6291be9c5f97c278418b241b79
SSDEEP

12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6TiOx6yB1/iGK4UlUuTh1AG:UB1BVpmExDYp38X8LYTWhOfNiGQl/91h

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 4 IoCs

Hijack Execution Flow

description	ioc
/bin/xscwlblmay	/bin/xscwlblmay
/bin/cbmedlvoic	/bin/cbmedlvoic
/bin/jbijdvlkyt	/bin/jbijdvlkyt
/bin/mepfraymdx	/bin/mepfraymdx

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Scheduled Task

description	ioc	Process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

Boot or Logon Autostart Execution

description	ioc
/etc/init.d/?��+?��?��+?��	/etc/init.d/?��+?��?��+?��

Modifies rc script 1 TTPs 17 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

Boot or Logon Autostart Execution

description	ioc	Process
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc2.d/S90?��+?��?��+?��	/etc/rc2.d/S90?��+?��?��+?��	Process not Found
/etc/rc4.d/S90?��+?��?��+?��	/etc/rc4.d/S90?��+?��?��+?��	Process not Found
/etc/rc3.d/S90a08	/etc/rc3.d/S90a08	Process not Found
/etc/rc5.d/S90a08	/etc/rc5.d/S90a08	Process not Found
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc1.d/S90?��+?��?��+?��	/etc/rc1.d/S90?��+?��?��+?��	Process not Found
/etc/rc3.d/S90?��+?��?��+?��	/etc/rc3.d/S90?��+?��?��+?��	Process not Found
/etc/rc5.d/S90?��+?��?��+?��	/etc/rc5.d/S90?��+?��?��+?��	Process not Found
/etc/rc1.d/S90a08	/etc/rc1.d/S90a08	Process not Found
/etc/rc2.d/S90a08	/etc/rc2.d/S90a08	Process not Found
/etc/rc1.d/	/etc/rc1.d/	update-rc.d
/etc/rc4.d/S90a08	/etc/rc4.d/S90a08	Process not Found
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc5.d/	/etc/rc5.d/	update-rc.d

Write file to user bin folder 1 TTPs 6 IoCs

Hijack Execution Flow

description	ioc	Process
/usr/bin/jbijdvlkyt	/usr/bin/jbijdvlkyt	Process not Found
/usr/bin/mepfraymdx	/usr/bin/mepfraymdx	Process not Found
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d
/usr/bin/xscwlblmay	/usr/bin/xscwlblmay	Process not Found
/usr/bin/kaovqjvytm	/usr/bin/kaovqjvytm	Process not Found
/usr/bin/cbmedlvoic	/usr/bin/cbmedlvoic	Process not Found

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
/tmp/mepfraymdx	/tmp/mepfraymdx
/tmp/xscwlblmay	/tmp/xscwlblmay
/tmp/cbmedlvoic	/tmp/cbmedlvoic
/tmp/jbijdvlkyt	/tmp/jbijdvlkyt

/tmp/a08
/tmp/a08
1⤵
PID:610

/bin/chkconfig
chkconfig --add a08
1⤵
PID:613

/sbin/chkconfig
chkconfig --add a08
1⤵
PID:613

/usr/bin/chkconfig
chkconfig --add a08
1⤵
PID:613

/usr/sbin/chkconfig
chkconfig --add a08
1⤵
PID:613

/usr/local/bin/chkconfig
chkconfig --add a08
1⤵
PID:613

/usr/local/sbin/chkconfig
chkconfig --add a08
1⤵
PID:613

/usr/X11R6/bin/chkconfig
chkconfig --add a08
1⤵
PID:613

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:616
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:617

/bin/update-rc.d
update-rc.d a08 defaults
1⤵
PID:615

/sbin/update-rc.d
update-rc.d a08 defaults
1⤵
PID:615

/usr/bin/update-rc.d
update-rc.d a08 defaults
1⤵
PID:615

/usr/sbin/update-rc.d
update-rc.d a08 defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:615
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:619

/usr/bin/xscwlblmay
/usr/bin/xscwlblmay "ls -la" 611
1⤵
PID:642

/usr/bin/xscwlblmay
/usr/bin/xscwlblmay whoami 611
1⤵
PID:645

/usr/bin/xscwlblmay
/usr/bin/xscwlblmay "netstat -an" 611
1⤵
PID:648

/usr/bin/xscwlblmay
/usr/bin/xscwlblmay "netstat -an" 611
1⤵
PID:651

/usr/bin/xscwlblmay
/usr/bin/xscwlblmay id 611
1⤵
PID:654

/usr/bin/kaovqjvytm
/usr/bin/kaovqjvytm "ps -ef" 611
1⤵
PID:657

/usr/bin/kaovqjvytm
/usr/bin/kaovqjvytm "echo \"find\"" 611
1⤵
PID:660

/usr/bin/kaovqjvytm
/usr/bin/kaovqjvytm "ps -ef" 611
1⤵
PID:663

/usr/bin/kaovqjvytm
/usr/bin/kaovqjvytm "cat resolv.conf" 611
1⤵
PID:666

/usr/bin/kaovqjvytm
/usr/bin/kaovqjvytm "route -n" 611
1⤵
PID:669

/usr/bin/cbmedlvoic
/usr/bin/cbmedlvoic sh 611
1⤵
PID:672

/usr/bin/cbmedlvoic
/usr/bin/cbmedlvoic ifconfig 611
1⤵
PID:675

/usr/bin/cbmedlvoic
/usr/bin/cbmedlvoic bash 611
1⤵
PID:678

/usr/bin/cbmedlvoic
/usr/bin/cbmedlvoic bash 611
1⤵
PID:684

/usr/bin/hyejseinoo
/usr/bin/hyejseinoo top 611
1⤵
PID:719

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task

Defense Evasion

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads