hxxp://track[.]mealgate[.]com/?xtl=1dwllwvqmtp2bs4hyjn337pgiyxf608ivxcn0oupf4xmnnrivzx3ivrcw173w8yrvpid7oro171fr5ba646snd1rzws5ezasw1yukm6jo14ng4h1otkiw1qgo2fhjftr22nqdpd9fugc4x4va9qw0mxbzb577ujc4e09g6hvrwnkkwn5ks9edq16prnm8wa7oqjiq51iztua8x8fc3o5kidyo4t3kpoof32trytjyzo0n8tl1ytddn3otnq07pnsu99g&eih=1l5wnyt7mvmj0rn8kf13pz70crct&__stmp=sc00yg&email=rcolwell1%40ewu[.]edu&first_name=Reynard&last_name=Colwell&newestsource&Source&YearAdded=2023

Resubmissions

24/04/2024, 22:56

240424-2wssasbc248

24/04/2024, 22:55

24/04/2024, 22:52

24/04/2024, 22:52

24/04/2024, 22:50

Analysis

max time kernel
30s
max time network
31s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
24/04/2024, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://track.mealgate.com/?xtl=1dwllwvqmtp2bs4hyjn337pgiyxf608ivxcn0oupf4xmnnrivzx3ivrcw173w8yrvpid7oro171fr5ba646snd1rzws5ezasw1yukm6jo14ng4h1otkiw1qgo2fhjftr22nqdpd9fugc4x4va9qw0mxbzb577ujc4e09g6hvrwnkkwn5ks9edq16prnm8wa7oqjiq51iztua8x8fc3o5kidyo4t3kpoof32trytjyzo0n8tl1ytddn3otnq07pnsu99g&eih=1l5wnyt7mvmj0rn8kf13pz70crct&__stmp=sc00yg&email=rcolwell1%40ewu.edu&first_name=Reynard&last_name=Colwell&newestsource&Source&YearAdded=2023
Sample240424-2v7vtsbb95

Score

4^/10

antivm

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1551	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1551	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1551	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1550	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1556	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1556	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1555	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1555	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1554	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1554	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1557	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1557	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1553	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1553	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1552	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1552	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1559	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1559	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1561	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1561	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1562	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1563	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1563	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1564	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1564	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1566	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1565	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1567	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1567	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1568	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1568	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1569	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1569	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1572	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1572	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1571	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1571	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1570	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1574	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1574	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1573	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1575	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1580	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1580	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1579	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1579	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1578	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1578	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1577	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1577	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1573	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1581	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1581	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1581	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1573	firefox
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1584	Process not Found
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1584	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1583	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1583	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1582	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1582	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1585	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1585	Process not Found
Changes the process name, possibly in an attempt to hide itself	gmain	1586	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	firefox

Reads CPU attributes 1 TTPs 16 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	firefox
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	firefox
File opened for reading	/sys/bus/pci/devices	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	firefox
File opened for reading	/sys/devices/system/cpu	firefox

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1659/statm	firefox
File opened for reading	/proc/1679/statm	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1711/statm	firefox
File opened for reading	/proc/self/fd/112	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/task/1772/stat	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/1590/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/self/fd/108	firefox
File opened for reading	/proc/self/task/1813/stat	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/fd/137	firefox
File opened for reading	/proc/1610/cmdline	dbus-daemon
File opened for reading	/proc/self/task/1732/stat	firefox
File opened for reading	/proc/self/fd/107	firefox
File opened for reading	/proc/1549/attr/current	dbus-daemon
File opened for reading	/proc/self/task/1576/stat	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/33	firefox
File opened for reading	/proc/1614/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/143	firefox
File opened for reading	/proc/1835/statm	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/task/1531/stat	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/self/task/1665/stat	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/114	firefox
File opened for reading	/proc/self/fd/113	firefox
File opened for reading	/proc/1549/status	dbus-daemon
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/1769/statm	firefox
File opened for reading	/proc/1728/statm	firefox
File opened for reading	/proc/self/fd/151	firefox
File opened for reading	/proc/1862/statm	firefox
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/self/fd/92	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1728/smaps	firefox
File opened for reading	/proc/1529/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/task/1895/stat	firefox
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	gvfsd

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/firefox
firefox -new-tab "http://track.mealgate.com/?xtl=1dwllwvqmtp2bs4hyjn337pgiyxf608ivxcn0oupf4xmnnrivzx3ivrcw173w8yrvpid7oro171fr5ba646snd1rzws5ezasw1yukm6jo14ng4h1otkiw1qgo2fhjftr22nqdpd9fugc4x4va9qw0mxbzb577ujc4e09g6hvrwnkkwn5ks9edq16prnm8wa7oqjiq51iztua8x8fc3o5kidyo4t3kpoof32trytjyzo0n8tl1ytddn3otnq07pnsu99g&eih=1l5wnyt7mvmj0rn8kf13pz70crct&__stmp=sc00yg&email=rcolwell1%40ewu.edu&first_name=Reynard&last_name=Colwell&newestsource&Source&YearAdded=2023"
1⤵
PID:1529
- /usr/bin/which
  which /usr/bin/firefox
  2⤵
  PID:1530

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -new-tab "http://track.mealgate.com/?xtl=1dwllwvqmtp2bs4hyjn337pgiyxf608ivxcn0oupf4xmnnrivzx3ivrcw173w8yrvpid7oro171fr5ba646snd1rzws5ezasw1yukm6jo14ng4h1otkiw1qgo2fhjftr22nqdpd9fugc4x4va9qw0mxbzb577ujc4e09g6hvrwnkkwn5ks9edq16prnm8wa7oqjiq51iztua8x8fc3o5kidyo4t3kpoof32trytjyzo0n8tl1ytddn3otnq07pnsu99g&eih=1l5wnyt7mvmj0rn8kf13pz70crct&__stmp=sc00yg&email=rcolwell1%40ewu.edu&first_name=Reynard&last_name=Colwell&newestsource&Source&YearAdded=2023"
1⤵
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1529
- /usr/bin/dbus-launch
  dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
  2⤵
  PID:1545
- - /usr/bin/dbus-daemon
    /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1547
  - - /usr/libexec/xdg-desktop-portal
      /usr/libexec/xdg-desktop-portal
      4⤵
      Reads runtime system information
      PID:1590
  - - /usr/libexec/xdg-document-portal
      /usr/libexec/xdg-document-portal
      4⤵
      Reads runtime system information
      PID:1595
  - - /usr/libexec/xdg-permission-store
      /usr/libexec/xdg-permission-store
      4⤵
      PID:1599
  - - /usr/libexec/xdg-desktop-portal-gtk
      /usr/libexec/xdg-desktop-portal-gtk
      4⤵
      PID:1610
  - - /usr/lib/gvfs/gvfsd
      /usr/lib/gvfs/gvfsd
      4⤵
      Reads runtime system information
      PID:1614
- /usr/bin/lsb_release
  /usr/bin/lsb_release -idrc
  2⤵
  PID:1560
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{596d3a6b-5a8c-46ca-9f12-9b3b13c66e4b}" 1529 true socket
  2⤵
  - Changes its process name
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1573
- /usr/local/sbin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1587
- /usr/local/bin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1587
- /usr/sbin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1587
- /usr/bin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1587
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21807 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{5051cfaa-7508-413b-8fb6-5b7b7aa4dbf5}" 1529 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1659
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21475 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{0777e142-21fc-4885-a7bf-2934144bd334}" 1529 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1679
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{b91290d9-edf1-4d5d-90fe-ffcfc58ea941}" 1529 true tab
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1711
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27881 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{5b69c794-b304-4839-b3de-b557311dde1e}" 1529 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1728
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 27388 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{c43c1bd4-f344-4fdd-bc34-00c237ef41f2}" 1529 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1769
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 6 -isForBrowser -prefsLen 27776 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{9ebc140d-f12b-4fbf-b973-dfd9378629aa}" 1529 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1794
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 7 -isForBrowser -prefsLen 27835 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{f9b3265f-5348-4154-aeb3-1934d8983e26}" 1529 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1806
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 8 -isForBrowser -prefsLen 27835 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{a5ee82b6-a1fd-4904-a9e2-b6e6c2a6cf8d}" 1529 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1835
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 9 -isForBrowser -prefsLen 27869 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{80290236-af85-4813-b0c7-89c405cad4bd}" 1529 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1862
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 10 -isForBrowser -prefsLen 27869 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{4908523a-34de-45d4-a9fd-afa9b79ac005}" 1529 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1892

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
PID:1619

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

user

Path /root/.cache/dconf/user
Size 2B
SHA256 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
MD5 c4103f122d27677c9db144cae1394a66
SHA1 1489f923c4dca729178b3e3233458550d8dddf29
SHA512 5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54
MD5 SHA1 SHA512

Submit Download

1643371321

Path /root/.cache/mozilla/firefox/9yxlywd7.default-release/cache2/doomed/1643371321
Size 9KB
SHA256 0fa6eb6fb6329fabc860db6cf6f8d5f454fd20f7add178ea1ce6893a4092b662
MD5 ea632d51dbb81494b7fb72cd264f37a9
SHA1 f4bb6618440ca4df25c9d20a05cb13e853171fb9
SHA512 75438f8cb5fd9b31a127b2726e48288a119219bf34c9f228586eb8421717bb994e7e0ccbd445d257546543128fbcb1bdd9b11079d3d6dd00ab4e62dcb011ad0c
SSDEEP 192:vH41r0dZ4eYvhid1ZFvC2rAl7YNCW2P8ro15j75ywpskCbdBEdBI:vY1r0dZ4eYq1HvCmAl7YNFU8rIVy8e5D
MD5 SHA1 SHA512 SSDEEP

Submit Download

1643371321

Path /root/.cache/mozilla/firefox/9yxlywd7.default-release/cache2/doomed/1643371321
Size 9KB
SHA256 990dbaf6e01eb8760c27ac838d9458c5d0ddb3404bced8d3e4c343b5b5b0810b
MD5 32695c97c3490b8a868628513336a9ce
SHA1 30be5d26bd9f3edbc2505c68e8e74db130dea7c9
SHA512 1abf767b4bf7bc4470db5bce1827285be677328bb4968f32540882a5463ad4291c8447e4f2a37f2376ab68a9e99a891c2a50322104516d9da6da472fc885a903
SSDEEP 192:241r0dZ4eYvhid1ZFvC2rAl7YNCW2P8ro15j75ywpskCbdBEdBI:H1r0dZ4eYq1HvCmAl7YNFU8rIVy8e5Bl
MD5 SHA1 SHA512 SSDEEP

Submit Download

1741535335

Path /root/.cache/mozilla/firefox/9yxlywd7.default-release/cache2/doomed/1741535335
Size 8KB
SHA256 412a0f7082cb62f31fe292d256d8e5a8930321f05264a96bbee20933a7f4d4f0
MD5 559fa8e5579cd839a2090025a70bff37
SHA1 4baaaf990d20efa0302c905470a9155708de6067
SHA512 6a63168e2b73a65f832d34259b008152c3a45ec5159a439ba80aa508761952bc35be0c78fce134de0d153ec6e7e52b556e5bd8c9d496e2578e16d64a1834e53b
SSDEEP 192:1gz3nCxft8ppxbJ/Cxft8ppxbqdLON0NLDcy1e0lpBNDIIcJdbdr:1gO5+bxbJK5+bxbqdLO4O0lpDIIcT5r
MD5 SHA1 SHA512 SSDEEP

Submit Download

037778A55E1B7E9BED3390289866D09402D6C913

Path /root/.cache/mozilla/firefox/9yxlywd7.default-release/cache2/entries/037778A55E1B7E9BED3390289866D09402D6C913
Size 9KB
SHA256 6d081c42e889f1d44829d4807db0b9e82415cde9bdb2b315714f612354b18690
MD5 cba93e894839ee1976bc75e70052c47a
SHA1 345e3783249d9fefec920e3d8ad560e136f85afe
SHA512 ad76b970cadab7829e0c69e27d9d49b8492de92c885f5beca8f03751575266a4032f599267560835ac47768b53e47df12faa7a9c938316e666c98768c863080b
SSDEEP 192:l41r0dZ4eYvhid1ZFvC2rAl7YNCW2P8ro15j75ywpskCbdO5dO9:O1r0dZ4eYq1HvCmAl7YNFU8rIVy8e5O2
MD5 SHA1 SHA512 SSDEEP

Submit Download

037778A55E1B7E9BED3390289866D09402D6C913

Path /root/.cache/mozilla/firefox/9yxlywd7.default-release/cache2/entries/037778A55E1B7E9BED3390289866D09402D6C913
Size 9KB
SHA256 9ba88efb871fd0035b3f5de34a1750dea3fea746d59f07798fec7f7bb8daa1e9
MD5 f52769ed07b9fafb10907a0dd29e3c44
SHA1 6602ab300bf6b5769c4c9662e574f768b3492450
SHA512 cbd8c78b88e771c0d720e4a45a79b75d9cd4bd5d82c0468ed31690cd60fa16f0f4982ecd524a075fda6267b5b77ee906310c0dad2e12753ff773570f7b4a227b
SSDEEP 192:F41r0dZ4eYvhid1ZFvC2rAl7YNCW2P8ro15j75ywpskCbdO5dO9:u1r0dZ4eYq1HvCmAl7YNFU8rIVy8e5O2
MD5 SHA1 SHA512 SSDEEP

Submit Download

039090029E64BC91E87E77199A6A6BE11FC39B6F

Path /root/.cache/mozilla/firefox/9yxlywd7.default-release/cache2/entries/039090029E64BC91E87E77199A6A6BE11FC39B6F
Size 8KB
SHA256 d05aef4baf5dfef535e3c6818df0499a1d48b70d95a549d8acf89943c8454dc0
MD5 af46fec3d555e6a0b978e7fe5106480c
SHA1 1762f1ba37ea31145b42114786d2c94b80d9bc95
SHA512 c60e52e8a711d1d8f0299097b7ebca9f2913512614cf9e6647e99d99dcc5dc71cd2b936f789ba09b1857ce2dc52025f35bf74cd8bb9ee5bfea7698691a8d4291
SSDEEP 192:X+o6OH+C0YOM9z5FwGCyIplXSVyXkkJguvpbYbmDASnIw:Z6OeB6zzCyIppSV05gE6baAi
MD5 SHA1 SHA512 SSDEEP

Submit Download