7f2d4cab8e49cbf846b82be3a54d5ff5f499ceb94a09a3445c04bbb1d1b4af72

General

Target

1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
Size

52KB
MD5

e09c5faa6cada81cab047c0fd3d49667
SHA1

eb2540d4edbcb3f5283f39dd874cb9d34eac0784
SHA256

7f2d4cab8e49cbf846b82be3a54d5ff5f499ceb94a09a3445c04bbb1d1b4af72
SHA512

64ef8a65fb7b0a82766488969d5d433af8877d55a68ce03c4ac8418404734c6e60aa0e8771e6e69eda7e1c3b2e7792365eaf84ba8c48a049bad374dd6b81e02a
SSDEEP

768:uGpjM9WF9ln3Hi8WX1gVHVMcV7gowbBnOvoElEb454vswyzT0IOCP/OPVzI5vs2:uGp2kln3Hi76V1yy3KUw8DePVc502

Score

7^/10

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp

description	ioc	process
File opened for modification	/dev/watchdog	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for modification	/dev/misc/watchdog	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

Processes:

1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp

description	ioc	process
File opened for modification	/sbin/watchdog	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for modification	/bin/watchdog	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp

description	ioc	process
File opened for reading	/proc/1061/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1132/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1186/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1350/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1626/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/668/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1014/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1057/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1189/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1543/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/486/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/438/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/459/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1064/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1232/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1333/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1584/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/407/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1146/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1108/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1342/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1533/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/716/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/948/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1161/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/481/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1009/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1109/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1137/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/466/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1179/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/953/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/650/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1302/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1327/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/471/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1248/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1256/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1310/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1382/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1608/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/483/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/944/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/529/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1151/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1590/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/405/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1124/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1238/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1602/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/537/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1632/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1564/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1149/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1084/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1120/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1291/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1464/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1530/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/492/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1191/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1182/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/647/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
File opened for reading	/proc/1142/cmdline	1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp

/tmp/1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
/tmp/1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1538