01da3129fcc3c998713575fd0e173ac4b4e8e4c5b208206257986055d686f4eb

Analysis

max time kernel
151s
max time network
15s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
10/03/2024, 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

724-1-0x00400000-0x00452a58-memory.dmp
Size

73KB
MD5

3052feb8cf25674797e76121f0d369e6
SHA1

0f6733f018ae167a2e10ef83e6964d05a66fd028
SHA256

01da3129fcc3c998713575fd0e173ac4b4e8e4c5b208206257986055d686f4eb
SHA512

9b177e230b0a765f9da51cc2eca775e4b3a432719de2baba5a80522d1cf6b68c79dde5c3cbe8f02effecbae634131cd4884be4f4b2e6b5c141f45b18442bcbad
SSDEEP

1536:oJPEBmW5iNWqcGTkP+XHZ84OqdZerEStpP:oJPEB8NWq9uTqd0R

Score

7^/10

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/sbin/watchdog
File opened for modification	/bin/watchdog

Reads runtime system information 17 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/550/cmdline
File opened for reading	/proc/696/cmdline
File opened for reading	/proc/736/cmdline
File opened for reading	/proc/791/cmdline
File opened for reading	/proc/689/cmdline
File opened for reading	/proc/704/cmdline
File opened for reading	/proc/714/cmdline
File opened for reading	/proc/718/cmdline
File opened for reading	/proc/784/cmdline
File opened for reading	/proc/683/cmdline
File opened for reading	/proc/716/cmdline
File opened for reading	/proc/717/cmdline
File opened for reading	/proc/731/cmdline
File opened for reading	/proc/783/cmdline
File opened for reading	/proc/427/cmdline
File opened for reading	/proc/541/cmdline
File opened for reading	/proc/711/cmdline

/tmp/724-1-0x00400000-0x00452a58-memory.dmp
/tmp/724-1-0x00400000-0x00452a58-memory.dmp
1⤵
PID:727

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads