8338534d04facffff321d78c9e8d6b6103aad98d8c116e9888bc15f7b93cd8d7

Analysis

max time kernel
153s
max time network
102s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
01/06/2023, 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

597-1-0x0000000008048000-0x00000000080547a0-memory.dmp
Size

48KB
MD5

9752ac4c4e7c894d88143921ecabe203
SHA1

44e1ac67d48a28c7621490130bfa04cf6f20d9ee
SHA256

8338534d04facffff321d78c9e8d6b6103aad98d8c116e9888bc15f7b93cd8d7
SHA512

b1b3295c2ae59ef86d62383ceab6cd3b0bcebe9e66a938996f7971549fc41ad83e9da39dc8928ac54ff8e72c3739a6f03da0241ad5585c52cd54f0b74b6092fc
SSDEEP

1536:6nJRT4QPfZfW5XTOeY3Dve/AGo2Mw/4Qwbbn2ireg:Gv4QPfZfW5XTOeoEzuwAQw/2i5

Score

7^/10

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/sbin/watchdog
File opened for modification	/bin/watchdog

Reads runtime system information 13 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/593/cmdline
File opened for reading	/proc/595/cmdline
File opened for reading	/proc/600/cmdline
File opened for reading	/proc/601/cmdline
File opened for reading	/proc/409/cmdline
File opened for reading	/proc/422/cmdline
File opened for reading	/proc/424/cmdline
File opened for reading	/proc/592/cmdline
File opened for reading	/proc/616/cmdline
File opened for reading	/proc/460/cmdline
File opened for reading	/proc/565/cmdline
File opened for reading	/proc/594/cmdline
File opened for reading	/proc/620/cmdline

/tmp/597-1-0x0000000008048000-0x00000000080547a0-memory.dmp
/tmp/597-1-0x0000000008048000-0x00000000080547a0-memory.dmp
1⤵
PID:597

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads