41fe2916ce2b5dfe725f44a8aff183b6a870e233477a9d4f139dacd2e03ffc13

Analysis

max time kernel
151s
max time network
10s
platform
debian-9_mips
resource
debian9-mipsbe-20231026-en
resource tags

arch:mipsimage:debian9-mipsbe-20231026-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
19-11-2023 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

724-1-0x00400000-0x00451a58-memory.dmp
Size

69KB
MD5

5fd22931be7fd09a04873e25a44a8573
SHA1

f95a49bab1c4a42494b710ddd241e54a1c1cd281
SHA256

41fe2916ce2b5dfe725f44a8aff183b6a870e233477a9d4f139dacd2e03ffc13
SHA512

94232eb8b808237a783f6a850f084f3c9bacc3dbb458b539ac4458746df2ebaac91a5e6bfa064df891c9d08e797ea4107a1dee8866bb71320c038bf1362f1150
SSDEEP

768:kZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAv:BnN4ZH2SyOyuIq8LMEIUq+cvtpvXzWLe

Score

7^/10

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/sbin/watchdog
File opened for modification	/bin/watchdog

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/460/cmdline
File opened for reading	/proc/673/cmdline
File opened for reading	/proc/781/cmdline
File opened for reading	/proc/504/cmdline
File opened for reading	/proc/688/cmdline
File opened for reading	/proc/694/cmdline
File opened for reading	/proc/744/cmdline
File opened for reading	/proc/757/cmdline
File opened for reading	/proc/689/cmdline
File opened for reading	/proc/693/cmdline
File opened for reading	/proc/751/cmdline
File opened for reading	/proc/768/cmdline
File opened for reading	/proc/788/cmdline
File opened for reading	/proc/707/cmdline
File opened for reading	/proc/743/cmdline
File opened for reading	/proc/780/cmdline
File opened for reading	/proc/767/cmdline
File opened for reading	/proc/467/cmdline
File opened for reading	/proc/697/cmdline
File opened for reading	/proc/723/cmdline
File opened for reading	/proc/801/cmdline
File opened for reading	/proc/760/cmdline
File opened for reading	/proc/802/cmdline
File opened for reading	/proc/503/cmdline
File opened for reading	/proc/691/cmdline
File opened for reading	/proc/705/cmdline
File opened for reading	/proc/737/cmdline
File opened for reading	/proc/756/cmdline

/tmp/724-1-0x00400000-0x00451a58-memory.dmp
/tmp/724-1-0x00400000-0x00451a58-memory.dmp
1⤵
PID:701

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads