Analysis
-
max time kernel
152s -
max time network
153s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231221-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231221-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
12-02-2024 17:50
General
-
Target
1551-1-0x0000000008048000-0x0000000008067de0-memory.dmp
-
Size
68KB
-
MD5
f423f4b746bb8e94cc736adeb055ec2a
-
SHA1
9e59ee37f7d88c575577a4d234e53c11a1359bce
-
SHA256
785a72bba6f2790cb3046c24ad3df583b4d04d2a583545b19bee5150144a4980
-
SHA512
458c1030d155448a90f9712462b55a58b4ed14d43ab9c5595348e413c4687d207f6444e8b6c7cf9557a65ba1a3331de00ec3848ebb6ea38c3075c039198c0b23
-
SSDEEP
1536:4WLpwIfsfbIPuq2YMmhM9jZZmon3eQIZcW2K2FnBv1fY/IoxkPA:4WLpjfsfkP2ChC9ZGVB2tB9fqna4
Malware Config
Signatures
-
Contacts a large (75732) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
Processes:
1551-1-0x0000000008048000-0x0000000008067de0-memory.dmpdescription pid process Changes the process name, possibly in an attempt to hide itself 1561 1551-1-0x0000000008048000-0x0000000008067de0-memory.dmp -
Deletes itself 1 IoCs
Processes:
1551-1-0x0000000008048000-0x0000000008067de0-memory.dmppid process 1561 1551-1-0x0000000008048000-0x0000000008067de0-memory.dmp -
Processes:
description ioc File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal -
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
1551-1-0x0000000008048000-0x0000000008067de0-memory.dmpdescription ioc process File opened for modification /dev/watchdog 1551-1-0x0000000008048000-0x0000000008067de0-memory.dmp File opened for modification /dev/misc/watchdog 1551-1-0x0000000008048000-0x0000000008067de0-memory.dmp