Overview

overview

10

Static

static

7

sys.x86_64

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240226-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    13-04-2024 14:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sys.x86_64

  • Size

    3.7MB

  • MD5

    2bb292f0f9d28c5865cdfe601a082db6

  • SHA1

    e63ae8ef41496526bc59b04704e961472cabcc95

  • SHA256

    f878420a69fe3947bc79f8eca2c11418140a4a79380c6d18d4c907c9ccbc71f7

  • SHA512

    9026d43054f269b4c6e8758cfec571f9028269ce0275cbb41cb92e753dfe7f0b22f6b7b0e04ecb2cc58d3acef00fe2d3492f12d9b18e8a908ab3c288ea8d50a1

  • SSDEEP

    98304:LifkEQ5YQoProHC2ZXWw16hGkLTlPXW0XH:LYkEHbQRZX/O9ZO03

Score
10/10
xmrigantivmdiscoveryminerpersistencerootkitupx

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Contacts a large (167911) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads a kernel module 1 IoCs

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Attempts to change immutable files 14 IoCs

    Modifies inode attributes on the filesystem to allow changing of immutable files.

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Creates/modifies Cron job 1 TTPs 3 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 45 IoCs
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Writes file to system bin folder 1 TTPs 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Enumerates kernel/hardware configuration 1 TTPs 24 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes

  • /tmp/sys.x86_64
    /tmp/sys.x86_64
    1⤵
    • Deletes itself
    • Reads runtime system information
    PID:1519
    • /etc/ImageMagick-6/nhwm32/ksoftriqd
      ksoftriqd
      2⤵
      • Executes dropped EXE
      • Checks CPU configuration
      • Checks hardware identifiers (DMI)
      • Reads CPU attributes
      • Reads hardware information
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:1536
    • /bin/sh
      /bin/sh -c "chattr -R -ia /var/spool/cron;chattr -ia /etc/crontab;chattr -R -ia /var/spool/cron/crontabs;chattr -R -ia /etc/cron.d"
      2⤵
        PID:1559
        • /usr/bin/chattr
          chattr -R -ia /var/spool/cron
          3⤵
          • Attempts to change immutable files
          PID:1560
        • /usr/bin/chattr
          chattr -ia /etc/crontab
          3⤵
          • Attempts to change immutable files
          PID:1561
        • /usr/bin/chattr
          chattr -R -ia /var/spool/cron/crontabs
          3⤵
          • Attempts to change immutable files
          PID:1562
        • /usr/bin/chattr
          chattr -R -ia /etc/cron.d
          3⤵
          • Attempts to change immutable files
          PID:1563
      • /bin/sh
        /bin/sh -c "echo '* * * * * /dev/disk/nhwm32' | /usr/bin/crontab -"
        2⤵
          PID:1564
          • /usr/bin/crontab
            /usr/bin/crontab -
            3⤵
            • Creates/modifies Cron job
            PID:1566
        • /bin/sh
          /bin/sh -c "chattr -R -ia /var/spool/cron;chattr -ia /etc/crontab;chattr -R -ia /var/spool/cron/crontabs;chattr -R -ia /etc/cron.d"
          2⤵
          • Attempts to change immutable files
          PID:1574
          • /usr/bin/chattr
            chattr -R -ia /var/spool/cron
            3⤵
            • Attempts to change immutable files
            PID:1575
          • /usr/bin/chattr
            chattr -ia /etc/crontab
            3⤵
            • Attempts to change immutable files
            PID:1576
          • /usr/bin/chattr
            chattr -R -ia /var/spool/cron/crontabs
            3⤵
            • Attempts to change immutable files
            PID:1577
          • /usr/bin/chattr
            chattr -R -ia /etc/cron.d
            3⤵
            • Attempts to change immutable files
            PID:1578
        • /bin/sh
          /bin/sh -c "echo '* * * * * /boot/grub/nhwm32' | /usr/bin/crontab -"
          2⤵
            PID:1579
            • /usr/bin/crontab
              /usr/bin/crontab -
              3⤵
              • Creates/modifies Cron job
              PID:1581
          • /bin/sh
            /bin/sh -c "chattr -R -ia /var/spool/cron;chattr -ia /etc/crontab;chattr -R -ia /var/spool/cron/crontabs;chattr -R -ia /etc/cron.d"
            2⤵
            • Attempts to change immutable files
            PID:1587
            • /usr/bin/chattr
              chattr -R -ia /var/spool/cron
              3⤵
              • Attempts to change immutable files
              PID:1588
            • /usr/bin/chattr
              chattr -ia /etc/crontab
              3⤵
              • Attempts to change immutable files
              PID:1589
            • /usr/bin/chattr
              chattr -R -ia /var/spool/cron/crontabs
              3⤵
              • Attempts to change immutable files
              PID:1590
            • /usr/bin/chattr
              chattr -R -ia /etc/cron.d
              3⤵
              • Attempts to change immutable files
              PID:1591
          • /bin/sh
            /bin/sh -c "echo '* * * * * /etc/X11/xinit/nhwm32' | /usr/bin/crontab -"
            2⤵
              PID:1592
              • /usr/bin/crontab
                /usr/bin/crontab -
                3⤵
                • Creates/modifies Cron job
                PID:1594
          • /bin/sh
            sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"
            1⤵
              PID:1543
              • /sbin/modprobe
                /sbin/modprobe msr "allow_writes=on"
                2⤵
                • Loads a kernel module
                • Enumerates kernel/hardware configuration
                PID:1544

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Initial Access

            Execution

            Scheduled Task/Job

            1
            T1053

            Persistence

            Scheduled Task/Job

            1
            T1053

            Hijack Execution Flow

            1
            T1574

            Privilege Escalation

            Scheduled Task/Job

            1
            T1053

            Hijack Execution Flow

            1
            T1574

            Defense Evasion

            Virtualization/Sandbox Evasion

            2
            T1497

            Hijack Execution Flow

            1
            T1574

            Credential Access

            Discovery

            Network Service Discovery

            2
            T1046

            Virtualization/Sandbox Evasion

            2
            T1497

            System Network Connections Discovery

            1
            T1049

            System Information Discovery

            3
            T1082

            System Network Configuration Discovery

            1
            T1016

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Resource Development

            Reconnaissance

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /boot/grub/locale/nhwm32
              Filesize

              6.7MB

              MD5

              0e59a0f22f4d5720240b143e7752d7d1

              SHA1

              6ad64a0f2c81fd22f40e3d59cb100e8cd8fa2603

              SHA256

              9d4153c85f1315ae08955dc491294749b3603846d2f95de665d4bf655543be03

              SHA512

              277cb607d1e946f2fa9afb04155f0344befbea0da16ddc78f3cc74734920470a6cac843468c1d9bf035b775c097f64802cc5bf5d46a370599ac58364ba5a23fa

              Download Submit
            • /dev/disk/nhwm32
              Filesize

              3.7MB

              MD5

              2bb292f0f9d28c5865cdfe601a082db6

              SHA1

              e63ae8ef41496526bc59b04704e961472cabcc95

              SHA256

              f878420a69fe3947bc79f8eca2c11418140a4a79380c6d18d4c907c9ccbc71f7

              SHA512

              9026d43054f269b4c6e8758cfec571f9028269ce0275cbb41cb92e753dfe7f0b22f6b7b0e04ecb2cc58d3acef00fe2d3492f12d9b18e8a908ab3c288ea8d50a1

              Download Submit
            • /etc/ImageMagick-6/nhwm32/config.json
              Filesize

              1KB

              MD5

              7d886070895d519774e2c573909eca95

              SHA1

              012657db71d97037e954ab370bfa87a2a745a085

              SHA256

              72e34b826f4671be485d06143299270455f3c1a35ed8af5dde9b1ffe49b9501a

              SHA512

              33da7e43c967de6cb20f7ebca38dbee53223d61ecc1a01be0e392c1960b52e075d6fe4670b6cf84dd9cc2668c8a99a700358225ace0876b529b8e96e85240fb3

              Download Submit
            • /var/spool/cron/crontabs/tmp.BY6KU6
              Filesize

              207B

              MD5

              dc22a9ea33b35148fd87bb1834a380e5

              SHA1

              28c478ba4e3a8822fdbc67ddd6511e49c542f101

              SHA256

              8abb61ebacfb1157d4d071db8d79f8faa9cd49cb7f489c4bfc6e563ddd95dd4b

              SHA512

              55e72d80babc0c7272ab2f6aab4e38746f64213dffdd4a2a36f71ca4ad996cf12d69c45a6cb699969a445e47868148aef385e40ac02a8e10715f32e171e1a8b4

              Download Submit
            • /var/spool/cron/crontabs/tmp.PyAD1A
              Filesize

              202B

              MD5

              cb451366aa234fd690e29c0e4ca80fcd

              SHA1

              205a043b6ee01e8abafaddef1124a8a8f278ca9f

              SHA256

              3579087b816637a344f7197d98c76313706f4c8908d377860c09e0d661e31d42

              SHA512

              e203457dd3e68b4fd090959d5cf3ef7409ff4aa5254793e1f00c3d7dc86869392631372d1a8a7f51cec4b8eee8ec640b2bfb8d0760085847e0d78d39f20d99a2

              Download Submit
            • /var/spool/cron/crontabs/tmp.wqDon9
              Filesize

              203B

              MD5

              aed0a110a77ea47a9e2aa75bac608546

              SHA1

              a181e7599e8872715bd9df774b6ac9effa3ec8db

              SHA256

              8363a129dd88fb9128146ddda6018559a98ec170d0da25ca7972e8832b2320c2

              SHA512

              ff7b6511612342a0ee4be9f71c19148978152ec4b3622d3d40b494b14423d2e958d2eb0fea70e3bc955bd7e66bfff71bf0167cf428e55b05e7764a967f2edab1

              Download Submit
            • memory/1519-1-0x0000000000400000-0x00000000010a2f98-memory.dmp
              Download