Overview

overview

10

Static

static

1

sample

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    305s
  • max time network
    295s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20231215-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    07/01/2024, 14:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sample

  • Size

    5.7MB

  • MD5

    b3039abf2ad5202f4a9363b418002351

  • SHA1

    0ceb8ffb0be23b808b534d744440f4367e17b9c5

  • SHA256

    787e2c94e6d9ce5ec01f5cbe9ee2518431eca8523155526d6dc85934c9c5787c

  • SHA512

    8b1a1003a021d0f69b9295f496bf550932ce85b096ca7057632756348da1354c2b104ff36e901b27def030b79749c8fc7f54163d6195e5e0cb9b357353ee654e

  • SSDEEP

    49152:wCe/ydXZSrb/TJvO90dL3BmAFd4A64nsfJvaWi9sglz/KbwLjFfiawr1eAOkzDIK:3eidO9suPF+NL4FiBnIrb3rE

Score
10/10
xmrigantivmevasionminerrootkitupx

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 3 IoCs
    miner
  • Executes dropped EXE 3 IoCs
  • Loads a kernel module 1 IoCs

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks CPU configuration 1 TTPs 4 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Checks hardware identifiers (DMI) 1 TTPs 12 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 13 IoCs
  • Reads hardware information 1 TTPs 42 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Reads list of loaded kernel modules 1 TTPs 1 IoCs

    Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    evasion
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/sample
    /tmp/sample
    1⤵
      PID:1570
      • /tmp/sample
        /tmp/sample
        2⤵
        • Checks CPU configuration
        • Reads list of loaded kernel modules
        • Reads runtime system information
        • Writes file to tmp directory
        PID:1574
    • /bin/sh
      sh -c "pkill -f kdevtmpfsi"
      1⤵
        PID:1596
        • /usr/bin/pkill
          pkill -f kdevtmpfsi
          2⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1597
      • /bin/sh
        sh -c "pkill -f kdevtmpfsi"
        1⤵
          PID:1598
          • /usr/bin/pkill
            pkill -f kdevtmpfsi
            2⤵
            • Reads CPU attributes
            • Reads runtime system information
            PID:1599
        • /bin/sh
          sh -c "chmod +x /tmp/kdevtmpfsi"
          1⤵
            PID:1600
            • /bin/chmod
              chmod +x /tmp/kdevtmpfsi
              2⤵
                PID:1601
            • /bin/sh
              sh -c "/tmp/kdevtmpfsi &"
              1⤵
                PID:1602
              • /tmp/kdevtmpfsi
                /tmp/kdevtmpfsi
                1⤵
                • Executes dropped EXE
                • Checks CPU configuration
                • Checks hardware identifiers (DMI)
                • Reads CPU attributes
                • Reads hardware information
                • Enumerates kernel/hardware configuration
                • Reads runtime system information
                PID:1603
              • /bin/sh
                sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"
                1⤵
                  PID:1620
                  • /sbin/modprobe
                    /sbin/modprobe msr "allow_writes=on"
                    2⤵
                    • Loads a kernel module
                    PID:1621
                • /bin/sh
                  sh -c "pkill -f kdevtmpfsi"
                  1⤵
                    PID:1625
                    • /usr/bin/pkill
                      pkill -f kdevtmpfsi
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1626
                  • /bin/sh
                    sh -c "chmod +x /tmp/kdevtmpfsi"
                    1⤵
                      PID:1627
                      • /bin/chmod
                        chmod +x /tmp/kdevtmpfsi
                        2⤵
                          PID:1628
                      • /bin/sh
                        sh -c "/tmp/kdevtmpfsi &"
                        1⤵
                          PID:1629
                        • /tmp/kdevtmpfsi
                          /tmp/kdevtmpfsi
                          1⤵
                          • Executes dropped EXE
                          • Checks CPU configuration
                          • Checks hardware identifiers (DMI)
                          • Reads CPU attributes
                          • Reads hardware information
                          • Enumerates kernel/hardware configuration
                          PID:1630
                        • /bin/sh
                          sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"
                          1⤵
                            PID:1637
                            • /sbin/modprobe
                              /sbin/modprobe msr "allow_writes=on"
                              2⤵
                                PID:1638
                            • /bin/sh
                              sh -c "pkill -f kdevtmpfsi"
                              1⤵
                                PID:1640
                                • /usr/bin/pkill
                                  pkill -f kdevtmpfsi
                                  2⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:1641
                              • /bin/sh
                                sh -c "chmod +x /tmp/kdevtmpfsi"
                                1⤵
                                  PID:1642
                                  • /bin/chmod
                                    chmod +x /tmp/kdevtmpfsi
                                    2⤵
                                      PID:1643
                                  • /bin/sh
                                    sh -c "/tmp/kdevtmpfsi &"
                                    1⤵
                                      PID:1644
                                    • /tmp/kdevtmpfsi
                                      /tmp/kdevtmpfsi
                                      1⤵
                                      • Executes dropped EXE
                                      • Checks CPU configuration
                                      • Checks hardware identifiers (DMI)
                                      • Reads CPU attributes
                                      • Reads hardware information
                                      • Enumerates kernel/hardware configuration
                                      PID:1645
                                    • /bin/sh
                                      sh -c "chmod +x /tmp/.ICEd-unix/JsoyF"
                                      1⤵
                                        PID:1653

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • /tmp/.ICEd-unix/2348293019
                                        Filesize

                                        4B

                                        MD5

                                        e4873aa9a05cc5ed839561d121516766

                                        SHA1

                                        cc0152ff71fc8243f70c8e8478bd7de2aa387e2c

                                        SHA256

                                        c4c9f099e7a471df3389eeb1a1487cf95b5a46e997bf9614e3229114b6787dc6

                                        SHA512

                                        1186c52e6c56d3b4d4c9d587c4cd2c627c00752dfd8973ccb340117308ecdc7e3fa64ad00be8538f5cd52ca5a80a27b1d362a69345f8fbbe862fa3e9fba0cd2d

                                        Download Submit

                                      • /tmp/.ICEd-unix/uuid
                                        Filesize

                                        36B

                                        MD5

                                        eb941e9e756368f466de0cde7980ee58

                                        SHA1

                                        78a15983983f0f6874208d0ae7a50fd731f6a837

                                        SHA256

                                        a5361e503b35b469c4ff2437f2b2f1975f9d76b7869b6484b22fd78b53d016c9

                                        SHA512

                                        9beff0bfd1175259dc43e2aa6f8599f29dc7afbe311a01ce81981fec65be33bce4fe048528d727e8b3fd648e339a781482c516abb742d602a33c62b3bc207094

                                        Download Submit

                                      • /tmp/kdevtmpfsi
                                        Filesize

                                        2.0MB

                                        MD5

                                        c82bb3c68f7a033b407aa3f53827b7fd

                                        SHA1

                                        6296e8ed40e430480791bf7b4fcdafde5f834837

                                        SHA256

                                        6fc94d8aecc538b1d099a429fb68ac20d7b6ae8b3c7795ae72dd2b7107690b8f

                                        SHA512

                                        0412482bf1eaaf0c1fd795dd1253f3466db46f1d528297f4d9455dd59117097b4f53583405d77dd7bcc9ffc123cf65d5470f23e6075cbb61b01709f324347df5

                                        Download Submit