Analysis
-
max time kernel
149s -
max time network
130s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
24-04-2024 10:09
Behavioral task
behavioral1
Sample
1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
Resource
ubuntu1804-amd64-20240226-en
General
-
Target
1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
-
Size
52KB
-
MD5
e09c5faa6cada81cab047c0fd3d49667
-
SHA1
eb2540d4edbcb3f5283f39dd874cb9d34eac0784
-
SHA256
7f2d4cab8e49cbf846b82be3a54d5ff5f499ceb94a09a3445c04bbb1d1b4af72
-
SHA512
64ef8a65fb7b0a82766488969d5d433af8877d55a68ce03c4ac8418404734c6e60aa0e8771e6e69eda7e1c3b2e7792365eaf84ba8c48a049bad374dd6b81e02a
-
SSDEEP
768:uGpjM9WF9ln3Hi8WX1gVHVMcV7gowbBnOvoElEb454vswyzT0IOCP/OPVzI5vs2:uGp2kln3Hi76V1yy3KUw8DePVc502
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
1546-1-0x0000000008048000-0x00000000080558e8-memory.dmpdescription ioc process File opened for modification /dev/watchdog 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for modification /dev/misc/watchdog 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
1546-1-0x0000000008048000-0x00000000080558e8-memory.dmpdescription ioc process File opened for modification /sbin/watchdog 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for modification /bin/watchdog 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
1546-1-0x0000000008048000-0x00000000080558e8-memory.dmpdescription ioc process File opened for reading /proc/1061/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1132/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1186/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1350/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1626/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/668/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1014/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1057/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1189/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1543/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/486/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/438/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/459/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1064/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1232/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1333/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1584/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/407/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1146/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1108/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1342/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1533/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/716/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/948/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1161/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/481/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1009/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1109/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1137/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/466/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1179/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/953/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/650/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1302/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1327/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/471/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1248/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1256/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1310/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1382/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1608/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/483/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/944/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/529/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1151/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1590/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/405/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1124/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1238/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1602/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/537/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1632/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1564/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1149/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1084/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1120/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1291/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1464/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1530/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/492/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1191/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1182/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/647/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp File opened for reading /proc/1142/cmdline 1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp