Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
13-04-2024 14:28
General
-
Target
sys.x86_64
-
Size
3.7MB
-
MD5
2bb292f0f9d28c5865cdfe601a082db6
-
SHA1
e63ae8ef41496526bc59b04704e961472cabcc95
-
SHA256
f878420a69fe3947bc79f8eca2c11418140a4a79380c6d18d4c907c9ccbc71f7
-
SHA512
9026d43054f269b4c6e8758cfec571f9028269ce0275cbb41cb92e753dfe7f0b22f6b7b0e04ecb2cc58d3acef00fe2d3492f12d9b18e8a908ab3c288ea8d50a1
-
SSDEEP
98304:LifkEQ5YQoProHC2ZXWw16hGkLTlPXW0XH:LYkEHbQRZX/O9ZO03
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule /boot/grub/locale/nhwm32 family_xmrig /boot/grub/locale/nhwm32 xmrig -
Contacts a large (167911) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
Processes:
sys.x86_64pid process 1519 sys.x86_64 -
Executes dropped EXE 1 IoCs
Processes:
ksoftriqdioc pid process /etc/ImageMagick-6/nhwm32/ksoftriqd 1536 ksoftriqd -
Processes:
modprobeioc pid process /lib/modules/4.15.0-213-generic/kernel/arch/x86/kernel/msr.ko 1544 modprobe -
Processes:
resource yara_rule /dev/disk/nhwm32 upx -
Attempts to change immutable files 14 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
Processes:
chattrchattrchattrchattrshchattrshchattrchattrchattrchattrchattrchattrchattrpid process 1575 chattr 1577 chattr 1588 chattr 1560 chattr 1574 sh 1590 chattr 1587 sh 1589 chattr 1561 chattr 1563 chattr 1578 chattr 1591 chattr 1562 chattr 1576 chattr -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
ksoftriqddescription ioc process File opened for reading /proc/cpuinfo ksoftriqd -
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
Processes:
ksoftriqddescription ioc process File opened for reading /sys/devices/virtual/dmi/id/product_name ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/board_vendor ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/bios_vendor ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/sys_vendor ksoftriqd -
Creates/modifies Cron job 1 TTPs 3 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabcrontabcrontabdescription ioc process File opened for modification /var/spool/cron/crontabs/tmp.PyAD1A crontab File opened for modification /var/spool/cron/crontabs/tmp.wqDon9 crontab File opened for modification /var/spool/cron/crontabs/tmp.BY6KU6 crontab -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 45 IoCs
Processes:
ksoftriqddescription ioc process File opened for reading /sys/devices/system/cpu/cpu0/topology/die_cpus ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/type ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq ksoftriqd File opened for reading /sys/devices/system/cpu/possible ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/topology/core_id ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/size ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/level ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size ksoftriqd File opened for reading /sys/devices/system/cpu/online ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/topology/thread_siblings ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/topology/physical_package_id ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/level ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/type ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/id ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/type ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/id ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/id ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/topology/cluster_cpus ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/level ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/level ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/id ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index7/shared_cpu_map ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index8/shared_cpu_map ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/topology/core_siblings ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/type ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cache/index9/shared_cpu_map ksoftriqd File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/base_frequency ksoftriqd -
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
Processes:
ksoftriqddescription ioc process File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/chassis_type ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/bios_version ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/bios_date ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/board_version ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/product_serial ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/product_uuid ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/chassis_serial ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/product_version ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/chassis_version ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/board_serial ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag ksoftriqd File opened for reading /sys/devices/virtual/dmi/id/board_name ksoftriqd -
Writes file to system bin folder 1 TTPs 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
description ioc File opened for reading /proc/net/tcp -
Enumerates kernel/hardware configuration 1 TTPs 24 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
ksoftriqdmodprobedescription ioc File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages File opened for reading /sys/fs/cgroup/cpuset/cpuset.mems ksoftriqd File opened for reading /sys/kernel/mm/hugepages ksoftriqd File opened for reading /sys/devices/system/node/online ksoftriqd File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages ksoftriqd File opened for reading /sys/devices/system/node/node0/access0/initiators/write_latency ksoftriqd File opened for reading /sys/firmware/dmi/tables/smbios_entry_point File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages File opened for reading /sys/devices/system/node/node0/access0/initiators/read_bandwidth ksoftriqd File opened for reading /sys/fs/cgroup/unified/cgroup.controllers ksoftriqd File opened for reading /sys/devices/system/node/node0/cpumap ksoftriqd File opened for reading /sys/devices/system/node/node0/meminfo ksoftriqd File opened for reading /sys/devices/system/node/node0/hugepages ksoftriqd File opened for reading /sys/bus/dax/devices ksoftriqd File opened for reading /sys/devices/system/node/node0/access1/initiators ksoftriqd File opened for reading /sys/devices/system/node/node0/access0/initiators ksoftriqd File opened for reading /sys/devices/virtual/dmi/id ksoftriqd File opened for reading /sys/fs/cgroup/cpuset/cpuset.cpus ksoftriqd File opened for reading /sys/devices/system/cpu ksoftriqd File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages ksoftriqd File opened for reading /sys/devices/system/node/node0/access0/initiators/read_latency ksoftriqd File opened for reading /sys/firmware/dmi/tables/DMI File opened for reading /sys/module/msr/initstate modprobe File opened for reading /sys/devices/system/node/node0/access0/initiators/write_bandwidth ksoftriqd -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
sys.x86_64ksoftriqddescription ioc File opened for reading /proc/1099/stat File opened for reading /proc/156/cmdline sys.x86_64 File opened for reading /proc/1318/cmdline sys.x86_64 File opened for reading /proc/642/stat File opened for reading /proc/712/stat sys.x86_64 File opened for reading /proc/1155/fd File opened for reading /proc/168/exe sys.x86_64 File opened for reading /proc/436/cmdline sys.x86_64 File opened for reading /proc/20/fd File opened for reading /proc/485/stat File opened for reading /proc/1355/exe File opened for reading /proc/1145/exe sys.x86_64 File opened for reading /proc/1245/cmdline sys.x86_64 File opened for reading /proc/322/stat File opened for reading /proc/18/cmdline File opened for reading /proc/79/exe sys.x86_64 File opened for reading /proc/1214/stat File opened for reading /proc/1245/exe File opened for reading /proc/957/exe sys.x86_64 File opened for reading /proc/408/cmdline sys.x86_64 File opened for reading /proc/460/cmdline sys.x86_64 File opened for reading /proc/932/fd File opened for reading /proc/1245/cmdline File opened for reading /proc/15/cmdline File opened for reading /proc/31/stat sys.x86_64 File opened for reading /proc/170/cmdline File opened for reading /proc/98/stat sys.x86_64 File opened for reading /proc/172/cmdline sys.x86_64 File opened for reading /proc/20/exe sys.x86_64 File opened for reading /proc/957/stat File opened for reading /proc/1178/stat File opened for reading /proc/1244/exe File opened for reading /proc/160/cmdline File opened for reading /proc/meminfo File opened for reading /proc/1517/exe sys.x86_64 File opened for reading /proc/12/exe File opened for reading /proc/485/exe File opened for reading /proc/27/cmdline sys.x86_64 File opened for reading /proc/1099/cmdline sys.x86_64 File opened for reading /proc/1150/cmdline sys.x86_64 File opened for reading /proc/1154/stat sys.x86_64 File opened for reading /proc/30/fd File opened for reading /proc/543/fd File opened for reading /proc/26/stat File opened for reading /proc/197/stat File opened for reading /proc/22/exe File opened for reading /proc/24/exe sys.x86_64 File opened for reading /proc/508/stat sys.x86_64 File opened for reading /proc/167/fd File opened for reading /proc/521/fd File opened for reading /proc/21/exe File opened for reading /proc/23/exe File opened for reading /proc/driver/nvidia/gpus ksoftriqd File opened for reading /proc/466/stat File opened for reading /proc/166/cmdline sys.x86_64 File opened for reading /proc/28/stat sys.x86_64 File opened for reading /proc/1295/exe sys.x86_64 File opened for reading /proc/1023/cmdline File opened for reading /proc/1153/exe File opened for reading /proc/1182/exe File opened for reading /proc/1191/exe sys.x86_64 File opened for reading /proc/962/stat File opened for reading /proc/25/cmdline File opened for reading /proc/28/exe -
Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
Processes:
description ioc File opened for modification /dev/shm/nhwm32
Processes
-
/tmp/sys.x86_64/tmp/sys.x86_641⤵
- Deletes itself
- Reads runtime system information
-
/etc/ImageMagick-6/nhwm32/ksoftriqdksoftriqd2⤵
- Executes dropped EXE
- Checks CPU configuration
- Checks hardware identifiers (DMI)
- Reads CPU attributes
- Reads hardware information
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/sh/bin/sh -c "chattr -R -ia /var/spool/cron;chattr -ia /etc/crontab;chattr -R -ia /var/spool/cron/crontabs;chattr -R -ia /etc/cron.d"2⤵
-
/usr/bin/chattrchattr -R -ia /var/spool/cron3⤵
- Attempts to change immutable files
-
/usr/bin/chattrchattr -ia /etc/crontab3⤵
- Attempts to change immutable files
-
/usr/bin/chattrchattr -R -ia /var/spool/cron/crontabs3⤵
- Attempts to change immutable files
-
/usr/bin/chattrchattr -R -ia /etc/cron.d3⤵
- Attempts to change immutable files
-
/bin/sh/bin/sh -c "echo '* * * * * /dev/disk/nhwm32' | /usr/bin/crontab -"2⤵
-
/usr/bin/crontab/usr/bin/crontab -3⤵
- Creates/modifies Cron job
-
/bin/sh/bin/sh -c "chattr -R -ia /var/spool/cron;chattr -ia /etc/crontab;chattr -R -ia /var/spool/cron/crontabs;chattr -R -ia /etc/cron.d"2⤵
- Attempts to change immutable files
-
/usr/bin/chattrchattr -R -ia /var/spool/cron3⤵
- Attempts to change immutable files
-
/usr/bin/chattrchattr -ia /etc/crontab3⤵
- Attempts to change immutable files
-
/usr/bin/chattrchattr -R -ia /var/spool/cron/crontabs3⤵
- Attempts to change immutable files
-
/usr/bin/chattrchattr -R -ia /etc/cron.d3⤵
- Attempts to change immutable files
-
/bin/sh/bin/sh -c "echo '* * * * * /boot/grub/nhwm32' | /usr/bin/crontab -"2⤵
-
/usr/bin/crontab/usr/bin/crontab -3⤵
- Creates/modifies Cron job
-
/bin/sh/bin/sh -c "chattr -R -ia /var/spool/cron;chattr -ia /etc/crontab;chattr -R -ia /var/spool/cron/crontabs;chattr -R -ia /etc/cron.d"2⤵
- Attempts to change immutable files
-
/usr/bin/chattrchattr -R -ia /var/spool/cron3⤵
- Attempts to change immutable files
-
/usr/bin/chattrchattr -ia /etc/crontab3⤵
- Attempts to change immutable files
-
/usr/bin/chattrchattr -R -ia /var/spool/cron/crontabs3⤵
- Attempts to change immutable files
-
/usr/bin/chattrchattr -R -ia /etc/cron.d3⤵
- Attempts to change immutable files
-
/bin/sh/bin/sh -c "echo '* * * * * /etc/X11/xinit/nhwm32' | /usr/bin/crontab -"2⤵
-
/usr/bin/crontab/usr/bin/crontab -3⤵
- Creates/modifies Cron job
-
/bin/shsh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"1⤵
-
/sbin/modprobe/sbin/modprobe msr "allow_writes=on"2⤵
- Loads a kernel module
- Enumerates kernel/hardware configuration
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/boot/grub/locale/nhwm32Filesize
6.7MB
MD50e59a0f22f4d5720240b143e7752d7d1
SHA16ad64a0f2c81fd22f40e3d59cb100e8cd8fa2603
SHA2569d4153c85f1315ae08955dc491294749b3603846d2f95de665d4bf655543be03
SHA512277cb607d1e946f2fa9afb04155f0344befbea0da16ddc78f3cc74734920470a6cac843468c1d9bf035b775c097f64802cc5bf5d46a370599ac58364ba5a23fa
-
/dev/disk/nhwm32Filesize
3.7MB
MD52bb292f0f9d28c5865cdfe601a082db6
SHA1e63ae8ef41496526bc59b04704e961472cabcc95
SHA256f878420a69fe3947bc79f8eca2c11418140a4a79380c6d18d4c907c9ccbc71f7
SHA5129026d43054f269b4c6e8758cfec571f9028269ce0275cbb41cb92e753dfe7f0b22f6b7b0e04ecb2cc58d3acef00fe2d3492f12d9b18e8a908ab3c288ea8d50a1
-
/etc/ImageMagick-6/nhwm32/config.jsonFilesize
1KB
MD57d886070895d519774e2c573909eca95
SHA1012657db71d97037e954ab370bfa87a2a745a085
SHA25672e34b826f4671be485d06143299270455f3c1a35ed8af5dde9b1ffe49b9501a
SHA51233da7e43c967de6cb20f7ebca38dbee53223d61ecc1a01be0e392c1960b52e075d6fe4670b6cf84dd9cc2668c8a99a700358225ace0876b529b8e96e85240fb3
-
/var/spool/cron/crontabs/tmp.BY6KU6Filesize
207B
MD5dc22a9ea33b35148fd87bb1834a380e5
SHA128c478ba4e3a8822fdbc67ddd6511e49c542f101
SHA2568abb61ebacfb1157d4d071db8d79f8faa9cd49cb7f489c4bfc6e563ddd95dd4b
SHA51255e72d80babc0c7272ab2f6aab4e38746f64213dffdd4a2a36f71ca4ad996cf12d69c45a6cb699969a445e47868148aef385e40ac02a8e10715f32e171e1a8b4
-
/var/spool/cron/crontabs/tmp.PyAD1AFilesize
202B
MD5cb451366aa234fd690e29c0e4ca80fcd
SHA1205a043b6ee01e8abafaddef1124a8a8f278ca9f
SHA2563579087b816637a344f7197d98c76313706f4c8908d377860c09e0d661e31d42
SHA512e203457dd3e68b4fd090959d5cf3ef7409ff4aa5254793e1f00c3d7dc86869392631372d1a8a7f51cec4b8eee8ec640b2bfb8d0760085847e0d78d39f20d99a2
-
/var/spool/cron/crontabs/tmp.wqDon9Filesize
203B
MD5aed0a110a77ea47a9e2aa75bac608546
SHA1a181e7599e8872715bd9df774b6ac9effa3ec8db
SHA2568363a129dd88fb9128146ddda6018559a98ec170d0da25ca7972e8832b2320c2
SHA512ff7b6511612342a0ee4be9f71c19148978152ec4b3622d3d40b494b14423d2e958d2eb0fea70e3bc955bd7e66bfff71bf0167cf428e55b05e7764a967f2edab1
-
memory/1519-1-0x0000000000400000-0x00000000010a2f98-memory.dmp