Analysis
-
max time kernel
155s -
max time network
158s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
12-02-2024 17:41
General
-
Target
1559-1-0x0000000000400000-0x0000000000524748-memory.dmp
-
Size
69KB
-
MD5
f38ca08d687989196c02903db58eae03
-
SHA1
bdbcb153eaf1db45a179feb7cfe1fd37f93ef73c
-
SHA256
58fd767fd281ead35ef21dcbc831629fa4a9855dc70800cf94cb91cdd7503d7c
-
SHA512
92143248a9e2f68860e6111e0a45915f77d16493a95820865e71dd7896c4cc559f3067aa13633ca6203f2812559ec6987b7f816b3a083b1b9546d78566e9c96e
-
SSDEEP
1536:aocdNAcs299EkhjgvZyoiPPWA6pRs0afqcl2rjTaXHjPE5UZLGBgHxyQ:qdiX29/hgvZ2PWAAqfEnMHj9LGB+sQ
Malware Config
Signatures
-
Contacts a large (71644) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
Processes:
1559-1-0x0000000000400000-0x0000000000524748-memory.dmpdescription ioc pid process Changes the process name, possibly in an attempt to hide itself 2p7pv7vgiknokwro 1544 1559-1-0x0000000000400000-0x0000000000524748-memory.dmp -
Deletes itself 1 IoCs
Processes:
1559-1-0x0000000000400000-0x0000000000524748-memory.dmppid process 1544 1559-1-0x0000000000400000-0x0000000000524748-memory.dmp -
Processes:
description ioc File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal -
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
1559-1-0x0000000000400000-0x0000000000524748-memory.dmpdescription ioc process File opened for modification /dev/watchdog 1559-1-0x0000000000400000-0x0000000000524748-memory.dmp File opened for modification /dev/misc/watchdog 1559-1-0x0000000000400000-0x0000000000524748-memory.dmp