Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
06/04/2024, 15:45
Behavioral task
behavioral1
Sample
653-1-0x00008000-0x000184d8-memory.dmp
Resource
debian9-armhf-20240226-en
General
-
Target
653-1-0x00008000-0x000184d8-memory.dmp
-
Size
64KB
-
MD5
724e9d59ebd36dd1eecbb2eceed1aadf
-
SHA1
a83b703d2d23f2611abfb7814608aa0c2466d10d
-
SHA256
24c764cd4975f7c2b7b59f912fad33214c922c17c347cd3f60eedcb1eafb5741
-
SHA512
9cce860f6ab0f6fc0cd331444822f836e578c50f3f4940eaaa365bc52400734303daea1e717cb5c1227e8e2640c222da26bd56d94b3c72564606e20ff4525084
-
SSDEEP
1536:R38+t0QPa9ckvqoA6uxlnVEGiJTKr8Lscikt5PvZkCB76G:R38+ZVeJ+4HLbPvZl7/
Malware Config
Signatures
-
Contacts a large (113603) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 666 653-1-0x00008000-0x000184d8-memory.dmp -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 653-1-0x00008000-0x000184d8-memory.dmp File opened for modification /dev/misc/watchdog 653-1-0x00008000-0x000184d8-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/798/cmdline File opened for reading /proc/26/cmdline File opened for reading /proc/796/cmdline File opened for reading /proc/604/cmdline File opened for reading /proc/20/cmdline File opened for reading /proc/106/cmdline File opened for reading /proc/283/cmdline File opened for reading /proc/659/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/147/cmdline File opened for reading /proc/165/cmdline File opened for reading /proc/285/cmdline File opened for reading /proc/658/cmdline File opened for reading /proc/800/cmdline File opened for reading /proc/8/cmdline File opened for reading /proc/43/cmdline File opened for reading /proc/15/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/29/cmdline File opened for reading /proc/286/cmdline File opened for reading /proc/664/cmdline File opened for reading /proc/784/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/13/cmdline File opened for reading /proc/281/cmdline File opened for reading /proc/607/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/18/cmdline File opened for reading /proc/312/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/98/cmdline File opened for reading /proc/332/cmdline File opened for reading /proc/670/cmdline File opened for reading /proc/788/cmdline File opened for reading /proc/794/cmdline File opened for reading /proc/10/cmdline File opened for reading /proc/27/cmdline File opened for reading /proc/602/cmdline File opened for reading /proc/651/cmdline File opened for reading /proc/662/cmdline File opened for reading /proc/673/cmdline File opened for reading /proc/773/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/108/cmdline File opened for reading /proc/137/cmdline File opened for reading /proc/669/cmdline File opened for reading /proc/7/cmdline File opened for reading /proc/41/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/24/cmdline File opened for reading /proc/138/cmdline File opened for reading /proc/309/cmdline File opened for reading /proc/792/cmdline File opened for reading /proc/2/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/109/cmdline File opened for reading /proc/618/cmdline File opened for reading /proc/777/cmdline File opened for reading /proc/25/cmdline File opened for reading /proc/42/cmdline File opened for reading /proc/229/cmdline File opened for reading /proc/608/cmdline File opened for reading /proc/782/cmdline