693835ecf1e4cb184b4dc9ce9145bb5ed1ec1840d83df8dc500d3c8d233b46fd

Analysis

max time kernel
142s
max time network
153s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/12/2023, 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5badeb16414cba66999742601c092b8
Size

141KB
MD5

b5badeb16414cba66999742601c092b8
SHA1

cc946b2c2e5cb0b28873c9f7ff4d17ee593fc3c2
SHA256

693835ecf1e4cb184b4dc9ce9145bb5ed1ec1840d83df8dc500d3c8d233b46fd
SHA512

df35a692d568e579c8affea2b5ce183f323b7bfdacdbb258f7983362684dcf3dd7b8bf70ab641915d9ff45a1f7bef66fcc0873d801f2d4543dcbbb39fe8d2f51
SSDEEP

3072:eWj2XFPG3QLoqnl0mGDhtn0B4ANKG7F/8GQxe83RL:esEmmGDDnnANKG7F/8GQxe83RL

Score

6^/10

persistence

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/etc/crontab	b5badeb16414cba66999742601c092b8

Modifies rc script 1 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/rc.local	b5badeb16414cba66999742601c092b8

Writes file to system bin folder 1 TTPs 3 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/b5badeb16414cba66999742601c092b8crontab	b5badeb16414cba66999742601c092b8
File opened for modification	/bin/b5badeb16414cba66999742601c092b8.local	b5badeb16414cba66999742601c092b8
File opened for modification	/bin/b5badeb16414cba66999742601c092b8.sh	b5badeb16414cba66999742601c092b8

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl

/tmp/b5badeb16414cba66999742601c092b8
/tmp/b5badeb16414cba66999742601c092b8
1⤵
- Creates/modifies Cron job
- Modifies rc script
- Writes file to system bin folder
PID:1528
- /bin/sh
  sh -c "service crond start"
  2⤵
  PID:1529
- - /usr/sbin/service
    service crond start
    3⤵
    PID:1530
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1531
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1532
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Reads runtime system information
      PID:1533
  - - /bin/systemctl
      systemctl -p Triggers show acpid.socket
      4⤵
      Reads runtime system information
      PID:1540
  - - /bin/systemctl
      systemctl -p Triggers show apport-forward.socket
      4⤵
      Reads runtime system information
      PID:1541
  - - /bin/systemctl
      systemctl -p Triggers show avahi-daemon.socket
      4⤵
      Reads runtime system information
      PID:1542
  - - /bin/systemctl
      systemctl -p Triggers show cups.socket
      4⤵
      Reads runtime system information
      PID:1543
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      Reads runtime system information
      PID:1544
  - - /bin/systemctl
      systemctl -p Triggers show saned.socket
      4⤵
      Reads runtime system information
      PID:1545
  - - /bin/systemctl
      systemctl -p Triggers show snapd.socket
      4⤵
      Reads runtime system information
      PID:1546
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Reads runtime system information
      PID:1547
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Reads runtime system information
      PID:1548
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Reads runtime system information
      PID:1549
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Reads runtime system information
      PID:1550
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Reads runtime system information
      PID:1551
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Reads runtime system information
      PID:1552
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Reads runtime system information
      PID:1553
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Reads runtime system information
      PID:1554
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Reads runtime system information
      PID:1555
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Reads runtime system information
      PID:1556
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Reads runtime system information
      PID:1557
  - - /bin/systemctl
      systemctl -p Triggers show uuidd.socket
      4⤵
      Reads runtime system information
      PID:1558
- - /usr/local/sbin/systemctl
    systemctl start crond.service
    3⤵
    PID:1530
- - /usr/local/bin/systemctl
    systemctl start crond.service
    3⤵
    PID:1530
- - /usr/sbin/systemctl
    systemctl start crond.service
    3⤵
    PID:1530
- - /usr/bin/systemctl
    systemctl start crond.service
    3⤵
    PID:1530
- - /sbin/systemctl
    systemctl start crond.service
    3⤵
    PID:1530
- - /bin/systemctl
    systemctl start crond.service
    3⤵
    - Reads runtime system information
    PID:1530
- /bin/sh
  sh -c "/etc/rc.d/init.d/crond start"
  2⤵
  PID:1559
- - /etc/rc.d/init.d/crond
    /etc/rc.d/init.d/crond start
    3⤵
    PID:1560
- /bin/sh
  sh -c "chmod 777 /bin/b5badeb16414cba66999742601c092b8.sh"
  2⤵
  PID:1561
- - /bin/chmod
    chmod 777 /bin/b5badeb16414cba66999742601c092b8.sh
    3⤵
    PID:1562

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Reads runtime system information
PID:1535

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:1537

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/bin/b5badeb16414cba66999742601c092b8.local

Filesize
38B

MD5
a703226f99dfe0657ae51dde6619e57a

SHA1
a7551613d368d0d61721b75481ce9006a3cf2e6a

SHA256
6f6dc41f6e2485e6129169c5024f7c6de371701f08d60405330561dc4881b301

SHA512
ce6db43dad806aa4ae0f94bfad79498363a34deda11f328470fe74635f31441a6027162add248bff5a1e0f46885a08ab5e0ad9d9299ecbca14430ff6b4ab4c88

Download Submit
/bin/b5badeb16414cba66999742601c092b8crontab

Filesize
782B

MD5
2e7a00b5e47265737061f89cb5a96d72

SHA1
647cf1241cf4f7a4e1956076cb6e2f3b48ad8f92

SHA256
dd32a5ddc627792bfa7c973edd3316f157f364f45a3de92b47c2281584c1de6a

SHA512
79294e6c21b69b78b9cda54fd9e6d769ed8221cf7a8ac1ccc964054b348dab5add50419734485c89d9f48505392510f2068ba2141299049d8197cf9fa892b7cc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads