839cb5185b0e178c24167611105825452ef842ac43c442f27511374c0ea0895c

Analysis

max time kernel
149s
max time network
131s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
16-03-2024 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1469-1-0x0000000008048000-0x00000000080547a0-memory.dmp
Size

48KB
MD5

da493663589d953fdf096ea5ec8901b4
SHA1

18ecfe8fe2ae247488f88cd0446fd92735912c56
SHA256

839cb5185b0e178c24167611105825452ef842ac43c442f27511374c0ea0895c
SHA512

3baf137e998d57baba01c47825933ad618611e04d2b7805c99e1dd53a05bec7226963f36dd5478b2608e70b16bce6de1443363ba45536949341df831452052c9
SSDEEP

1536:6nJRT4QPfZfW5XTOeY3Dve3AGX57/4Qw7bn2iBeA:Gv4QPfZfW5XTOeoEzJ7AQwf2i/

Score

7^/10

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Processes:

description ioc

File opened for modification /dev/watchdog
File opened for modification /dev/misc/watchdog
Enumerates running processes
Discovers information about currently running processes on the system
Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

description ioc

File opened for modification /sbin/watchdog
File opened for modification /bin/watchdog

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

description	ioc
File opened for modification	/sbin/watchdog
File opened for modification	/bin/watchdog

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
File opened for reading	/proc/1429/cmdline
File opened for reading	/proc/1432/cmdline
File opened for reading	/proc/498/cmdline
File opened for reading	/proc/694/cmdline
File opened for reading	/proc/960/cmdline
File opened for reading	/proc/972/cmdline
File opened for reading	/proc/1141/cmdline
File opened for reading	/proc/1318/cmdline
File opened for reading	/proc/794/cmdline
File opened for reading	/proc/1179/cmdline
File opened for reading	/proc/441/cmdline
File opened for reading	/proc/444/cmdline
File opened for reading	/proc/477/cmdline
File opened for reading	/proc/1433/cmdline
File opened for reading	/proc/1464/cmdline
File opened for reading	/proc/1547/cmdline
File opened for reading	/proc/1192/cmdline
File opened for reading	/proc/507/cmdline
File opened for reading	/proc/575/cmdline
File opened for reading	/proc/614/cmdline
File opened for reading	/proc/1041/cmdline
File opened for reading	/proc/1080/cmdline
File opened for reading	/proc/1122/cmdline
File opened for reading	/proc/488/cmdline
File opened for reading	/proc/500/cmdline
File opened for reading	/proc/1096/cmdline
File opened for reading	/proc/1529/cmdline
File opened for reading	/proc/1155/cmdline
File opened for reading	/proc/1426/cmdline
File opened for reading	/proc/1460/cmdline
File opened for reading	/proc/580/cmdline
File opened for reading	/proc/803/cmdline
File opened for reading	/proc/937/cmdline
File opened for reading	/proc/1037/cmdline
File opened for reading	/proc/1095/cmdline
File opened for reading	/proc/1305/cmdline
File opened for reading	/proc/439/cmdline
File opened for reading	/proc/981/cmdline
File opened for reading	/proc/1045/cmdline
File opened for reading	/proc/584/cmdline
File opened for reading	/proc/954/cmdline
File opened for reading	/proc/1431/cmdline
File opened for reading	/proc/483/cmdline
File opened for reading	/proc/567/cmdline
File opened for reading	/proc/587/cmdline
File opened for reading	/proc/809/cmdline
File opened for reading	/proc/1417/cmdline
File opened for reading	/proc/637/cmdline
File opened for reading	/proc/1540/cmdline
File opened for reading	/proc/438/cmdline
File opened for reading	/proc/535/cmdline
File opened for reading	/proc/828/cmdline
File opened for reading	/proc/1109/cmdline
File opened for reading	/proc/1421/cmdline
File opened for reading	/proc/616/cmdline
File opened for reading	/proc/1116/cmdline
File opened for reading	/proc/1128/cmdline
File opened for reading	/proc/1521/cmdline
File opened for reading	/proc/996/cmdline
File opened for reading	/proc/1785/cmdline
File opened for reading	/proc/874/cmdline
File opened for reading	/proc/904/cmdline
File opened for reading	/proc/967/cmdline
File opened for reading	/proc/493/cmdline

/tmp/1469-1-0x0000000008048000-0x00000000080547a0-memory.dmp
/tmp/1469-1-0x0000000008048000-0x00000000080547a0-memory.dmp
1⤵
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads