Analysis

  • max time kernel
    152s
  • max time network
    153s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20230831-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20230831-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    07/10/2023, 03:54

General

  • Target

    610-1-0x0000000008048000-0x000000001fdd1f40-memory.dmp

  • Size

    60KB

  • MD5

    2fa02a4bfa62df5929d313f5fcf988fe

  • SHA1

    58c152371322b223fdf5f397583fffa6f5afb868

  • SHA256

    bde714e2cf98ceb33c640336e49e0fe05fd83d3cf2687cb534517c50764d117a

  • SHA512

    46c2669626753a53dfab7223a4a7059f03409fbc30797ab0f92c44314fb1ac9eee8eafc277205ae093ca4cd97d96c65e7c8834ea5576fcd59e4b07213cba5f9a

  • SSDEEP

    1536:komhD78mgB03Z5vcYEdGUGU6+6DG5xzy6VXnUQvISBk+a:s7EYHvcYYGRUt4Gbzy69UQvLk+a

Score
7/10

Malware Config

Signatures

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets 1 TTPs 2 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/610-1-0x0000000008048000-0x000000001fdd1f40-memory.dmp
    /tmp/610-1-0x0000000008048000-0x000000001fdd1f40-memory.dmp
    1⤵
    • Enumerates active TCP sockets
    • Reads system network configuration
    PID:614

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads