f8865d3dbc980872ebf20f5bfc3109e868009c53437aca46b5e2253c11ce56d0

Analysis

max time kernel
155s
max time network
158s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-12-2023 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7f4c457e679eca4b666f79193ef29a8
Size

38KB
MD5

d7f4c457e679eca4b666f79193ef29a8
SHA1

d78c6201ed64824a6d2fd1147d3f03d5e865e6c7
SHA256

f8865d3dbc980872ebf20f5bfc3109e868009c53437aca46b5e2253c11ce56d0
SHA512

d19ab8ae02906905e80bab4d97c4b6328d32b05ddb98513943ad69c04184f88506a54ad9e0bbe60f1cc916027e6ef04ce99eb4aa2af6d805c94d5c7759176538
SSDEEP

768:2DOSXQLRyyX8D8AlfZD1l801MBENZ4/jLaNX9Ep0apvUrKnbcuyD7UyQRjcUON+k:kOSXQLRy484YfZDjNZ4/jLAXs0A9nouc

Score

7^/10

Malware Config

Signatures

Changes its process name 1 IoCs

Processes:

d7f4c457e679eca4b666f79193ef29a8

description pid process

Changes the process name, possibly in an attempt to hide itself 1551 d7f4c457e679eca4b666f79193ef29a8
Deletes itself 1 IoCs

Processes:

d7f4c457e679eca4b666f79193ef29a8

pid process

1551 d7f4c457e679eca4b666f79193ef29a8
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

d7f4c457e679eca4b666f79193ef29a8

description ioc process

File opened for reading /proc/net/route d7f4c457e679eca4b666f79193ef29a8
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

d7f4c457e679eca4b666f79193ef29a8

description ioc process

File opened for reading /proc/net/route d7f4c457e679eca4b666f79193ef29a8

description	pid	process
Changes the process name, possibly in an attempt to hide itself	1551	d7f4c457e679eca4b666f79193ef29a8

pid	process
1551	d7f4c457e679eca4b666f79193ef29a8

description	ioc	process
File opened for reading	/proc/net/route	d7f4c457e679eca4b666f79193ef29a8

description	ioc	process
File opened for reading	/proc/net/route	d7f4c457e679eca4b666f79193ef29a8

/tmp/d7f4c457e679eca4b666f79193ef29a8
/tmp/d7f4c457e679eca4b666f79193ef29a8
1⤵
- Changes its process name
- Deletes itself
- Reads system routing table
- Reads system network configuration
PID:1551

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1551-1-0x0000000008048000-0x000000000805fb64-memory.dmp

Download