Analysis
-
max time kernel
2s -
max time network
147s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
25-04-2024 01:23
Static task
static1
Behavioral task
behavioral1
Sample
4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elf
Resource
ubuntu2004-amd64-20240221-en
General
-
Target
4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elf
-
Size
274KB
-
MD5
6cef4e41b58be6fb4e2dd50c783c0c87
-
SHA1
fd5ded3422f64c3930e6541bd54dfb1083916f66
-
SHA256
4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28
-
SHA512
fbdd467bbf0a3b3cec9564075bfd5d977900acb502d1c15bfb9ba6920bea3cda92c62f15cf50c7335ffb43d6046581c0020a90cec3b6227b61a6b93135e5fe42
-
SSDEEP
6144:Uxc6tV4HX2TmFGR+WgB+Pjq32p5PPyMwsUpE9BNKaOA5IsY/Vi5iaL:KUtm+5QPjq3SIpLaOAGNK
Malware Config
Extracted
mirai
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 1 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elfdescription ioc process File opened for modification /dev/watchdog 4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elf -
Reads EFI boot settings 3 IoCs
Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
Processes:
systemctlsystemctlsystemctldescription ioc process File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl -
Unexpected DNS network traffic destination 12 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 54.36.111.116 Destination IP 94.247.43.254 Destination IP 114.114.114.114 Destination IP 114.114.114.114 Destination IP 114.114.114.114 Destination IP 94.247.43.254 Destination IP 1.0.0.1 Destination IP 168.138.12.137 Destination IP 134.195.4.2 Destination IP 114.114.114.114 Destination IP 192.3.165.37 Destination IP 114.114.114.114 -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc process File opened for modification /var/spool/cron/crontabs/tmp.Qs55aI crontab -
Processes:
4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elfdescription ioc process File opened for modification /etc/init.d/dnsconfig 4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elf -
Modifies systemd 1 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
Processes:
4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elfdescription ioc process File opened for modification /etc/systemd/system/dnsconfigs.service 4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elf -
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elfdescription ioc process File opened for modification /sbin/watchdog 4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elf File opened for modification /bin/watchdog 4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elf -
Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
systemctlsystemctlsystemctldescription ioc process File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl -
Reads runtime system information 23 IoCs
Reads data from /proc virtual filesystem.
Processes:
systemctlsystemctlsystemctl4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elfmountmountcpdescription ioc process File opened for reading /proc/1/environ systemctl File opened for reading /proc/sys/kernel/osrelease systemctl File opened for reading /proc/1/sched systemctl File opened for reading /proc/filesystems systemctl File opened for reading /proc/1/sched systemctl File opened for reading /proc/1493/cmdline 4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elf File opened for reading /proc/self/stat systemctl File opened for reading /proc/1/sched systemctl File opened for reading /proc/cmdline systemctl File opened for reading /proc/filesystems systemctl File opened for reading /proc/1/environ systemctl File opened for reading /proc/cmdline systemctl File opened for reading /proc/self/stat systemctl File opened for reading /proc/filesystems mount File opened for reading /proc/sys/kernel/osrelease systemctl File opened for reading /proc/1/environ systemctl File opened for reading /proc/cmdline systemctl File opened for reading /proc/filesystems systemctl File opened for reading /proc/self/exe 4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elf File opened for reading /proc/filesystems mount File opened for reading /proc/sys/kernel/osrelease systemctl File opened for reading /proc/filesystems cp File opened for reading /proc/self/stat systemctl -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elfdescription ioc process File opened for modification /tmp/server_session.lock 4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elf
Processes
-
/tmp/4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elf/tmp/4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elf1⤵
- Modifies Watchdog functionality
- Modifies init.d
- Modifies systemd
- Writes file to system bin folder
- Reads runtime system information
- Writes file to tmp directory
-
/bin/cpcp -f /tmp/4730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28.elf /var/tmp/nginx_kel2⤵
- Reads runtime system information
-
/bin/shsh -c "mount -o bind /tmp/nginx_server /proc/1493/ > /dev/null 2>&1"2⤵
-
/usr/bin/mountmount -o bind /tmp/nginx_server /proc/1493/3⤵
- Reads runtime system information
-
/bin/shsh -c "mount -o bind /tmp/nginx_server /proc/1500/ > /dev/null 2>&1"2⤵
-
/usr/bin/mountmount -o bind /tmp/nginx_server /proc/1500/3⤵
- Reads runtime system information
-
/bin/shsh -c "crontab /var/tmp/.recoverys"2⤵
-
/usr/bin/crontabcrontab /var/tmp/.recoverys3⤵
- Creates/modifies Cron job
-
/bin/shsh -c "ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig3⤵
-
/bin/shsh -c "ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig3⤵
-
/bin/shsh -c "ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig3⤵
-
/bin/shsh -c "systemctl daemon-reload > /dev/null 2>&1"2⤵
-
/usr/bin/systemctlsystemctl daemon-reload3⤵
- Reads EFI boot settings
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/shsh -c "ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig3⤵
-
/bin/shsh -c "ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig3⤵
-
/bin/shsh -c "ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig3⤵
-
/bin/shsh -c "ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig3⤵
-
/bin/shsh -c "ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig3⤵
-
/bin/shsh -c "ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig3⤵
-
/bin/shsh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs3⤵
-
/bin/shsh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs3⤵
-
/bin/shsh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs3⤵
-
/bin/shsh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs3⤵
-
/bin/shsh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs3⤵
-
/bin/shsh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs3⤵
-
/bin/shsh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs3⤵
-
/bin/shsh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs > /dev/null 2>&1"2⤵
-
/usr/bin/lnln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs3⤵
-
/bin/shsh -c "systemctl enable dnsconfigs.service > /dev/null 2>&1"2⤵
-
/usr/bin/systemctlsystemctl enable dnsconfigs.service3⤵
- Reads EFI boot settings
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/shsh -c "systemctl start dnsconfigs.service > /dev/null 2>&1"2⤵
-
/usr/bin/systemctlsystemctl start dnsconfigs.service3⤵
- Reads EFI boot settings
- Enumerates kernel/hardware configuration
- Reads runtime system information
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/etc/init.d/dnsconfigFilesize
1KB
MD5df56ea52b8cee93884f3872d25a85db0
SHA12fd0c7407ed67253a807d1d01c6ffd3467edaf8e
SHA256a402d683e16519793b06f663163d750b4e82922cf3b18af5a655de41328b9bf5
SHA512e390943755721ba7f0210439f0fc8e5e3daaf98ba1df923464aa547c5a7c6f941240658c8fa59270d6f73539fd8b0a04d7bdc9c407f13d9301588d5cf9aa68da
-
/etc/systemd/system/dnsconfigs.serviceFilesize
174B
MD5900f683b08977636b092fcbfa1ad8a42
SHA16d521f5c3e862f1106d9ac6a3a654e57e6814333
SHA25671d21310d1c7dbb935f3b61311403b0ec0fa32dc73f91720365416a646c2dfb3
SHA51250b5426500d8b5dccb7fd71fe9a448ae1c76770890ba86c37e7decbf2ca1f0e1cd20c50996260f37114ba2bdb16ae927e4afad241a51e3d22112ada8e25604b0
-
/tmp/server_session.lockFilesize
5B
MD5ede743815c46e331e8a5f5bf434ef184
SHA11d97af1de76c458776466b2834f43200d182823d
SHA256659ebd79973b79346dfcfdcb392bd25c2ee97a538e083b380838d84a3b6d48ff
SHA512f0d10cc9ea8116c72064366d5d682b6905cba1ece66e2a911afa4a336c5d49fdf047d51cd4385e4b05a8cefda5e5654195bb190619fb78e06d029a2b873eb607
-
/var/spool/cron/crontabs/tmp.Qs55aIFilesize
230B
MD5802bd757ffa2058108bd31af584b9e70
SHA10966f02a186d85ea361779a043cf00f763467c03
SHA2568c27dff93e30b953d1ea45ebb8d1eef83fba858ed26d70e923b57172df2ded46
SHA512fe5c0d523787967b790abc1b92f6edecaaa0f1db296a6d08cfbfa4900b1b36fad44c979d36ae97ec65d0b79e4895116af7eff83a78f4cfafbc12c2f52c13d91a
-
/var/tmp/.recoverysFilesize
37B
MD5abe9a0e06459d029e0f5183965dbbf3b
SHA17e79e16ea12fed960bcee8eb5a9c6384fa61a2d1
SHA256b2cfe7490d6dd2f81ede3ed9db30c78637f4a1e98ed746eaa00998e95d3de384
SHA512955aece23c24e5b1ce32a90fa014a8a6fac39b68707a13f56cd1bfb07c79dfc59806942732990aaf925db5724f381827e2c35eba21fe95ce9a760760527048cd
-
/var/tmp/nginx_kelFilesize
274KB
MD56cef4e41b58be6fb4e2dd50c783c0c87
SHA1fd5ded3422f64c3930e6541bd54dfb1083916f66
SHA2564730105d00af6296688da0b51f3b9be8ea81a4844a3a1d9996256fc218920f28
SHA512fbdd467bbf0a3b3cec9564075bfd5d977900acb502d1c15bfb9ba6920bea3cda92c62f15cf50c7335ffb43d6046581c0020a90cec3b6227b61a6b93135e5fe42
-
memory/1493-1-0x0000000000400000-0x00000000006a6bf8-memory.dmp