Resubmissions

27-04-2024 22:16

240427-16x94ahg24 7

27-04-2024 22:15

240427-16kzrshf94 7

27-04-2024 22:14

240427-152k5ahf82 4

Analysis

  • max time kernel
    39s
  • max time network
    41s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240418-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240418-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    27-04-2024 22:14

General

  • Target

    https://app.shop.pe/app/datapartners/status?usersite_id=605b561993f3c33a0f851b38

Score
4/10

Malware Config

Signatures

  • Changes its process name 64 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 14 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /usr/bin/firefox
    firefox -new-tab "https://app.shop.pe/app/datapartners/status?usersite_id=605b561993f3c33a0f851b38"
    1⤵
      PID:1498
      • /usr/bin/which
        which /usr/bin/firefox
        2⤵
          PID:1499
      • /usr/lib/firefox/firefox
        /usr/lib/firefox/firefox -new-tab "https://app.shop.pe/app/datapartners/status?usersite_id=605b561993f3c33a0f851b38"
        1⤵
        • Checks CPU configuration
        • Reads CPU attributes
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:1498
        • /usr/local/sbin/dbus-launch
          dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
          2⤵
            PID:1512
          • /usr/local/bin/dbus-launch
            dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
            2⤵
              PID:1512
            • /usr/sbin/dbus-launch
              dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
              2⤵
                PID:1512
              • /usr/bin/dbus-launch
                dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                2⤵
                  PID:1512
                  • /usr/bin/dbus-daemon
                    /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
                    3⤵
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:1514
                    • /usr/libexec/xdg-desktop-portal
                      /usr/libexec/xdg-desktop-portal
                      4⤵
                      • Reads runtime system information
                      PID:1566
                    • /usr/libexec/xdg-document-portal
                      /usr/libexec/xdg-document-portal
                      4⤵
                      • Reads runtime system information
                      PID:1571
                    • /usr/libexec/xdg-permission-store
                      /usr/libexec/xdg-permission-store
                      4⤵
                      • Reads runtime system information
                      PID:1577
                    • /usr/libexec/xdg-desktop-portal-gtk
                      /usr/libexec/xdg-desktop-portal-gtk
                      4⤵
                        PID:1587
                      • /usr/libexec/gvfsd
                        /usr/libexec/gvfsd
                        4⤵
                        • Reads runtime system information
                        PID:1594
                        • /usr/libexec/gvfsd-trash
                          /usr/libexec/gvfsd-trash --spawner :1.6 /org/gtk/gvfs/exec_spaw/0
                          5⤵
                          • Reads runtime system information
                          PID:1618
                      • /usr/libexec/dconf-service
                        /usr/libexec/dconf-service
                        4⤵
                        • Reads runtime system information
                        PID:1610
                      • /usr/bin/nautilus
                        /usr/bin/nautilus --gapplication-service
                        4⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:1615
                      • /usr/bin/gnome-keyring-daemon
                        /usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"
                        4⤵
                        • Reads runtime system information
                        PID:1841
                      • /usr/libexec/gvfs-udisks2-volume-monitor
                        /usr/libexec/gvfs-udisks2-volume-monitor
                        4⤵
                        • Reads runtime system information
                        PID:1851
                      • /usr/libexec/gvfs-afc-volume-monitor
                        /usr/libexec/gvfs-afc-volume-monitor
                        4⤵
                          PID:1857
                        • /usr/libexec/gvfs-mtp-volume-monitor
                          /usr/libexec/gvfs-mtp-volume-monitor
                          4⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:1863
                        • /usr/libexec/gvfs-gphoto2-volume-monitor
                          /usr/libexec/gvfs-gphoto2-volume-monitor
                          4⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:1869
                        • /usr/libexec/gvfs-goa-volume-monitor
                          /usr/libexec/gvfs-goa-volume-monitor
                          4⤵
                            PID:1874
                          • /usr/libexec/goa-daemon
                            /usr/libexec/goa-daemon
                            4⤵
                            • Reads runtime system information
                            PID:1878
                          • /usr/libexec/goa-identity-service
                            /usr/libexec/goa-identity-service
                            4⤵
                              PID:1885
                        • /usr/lib/firefox/glxtest
                          /usr/lib/firefox/glxtest -f 13
                          2⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:1519
                        • /usr/bin/lsb_release
                          /usr/bin/lsb_release -idrc
                          2⤵
                            PID:1531
                          • /usr/lib/firefox/firefox
                            /usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20252 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{2b00aaf7-0263-428c-be06-e1d83d52d4d7}" 1498 true socket
                            2⤵
                            • Changes its process name
                            • Reads CPU attributes
                            • Enumerates kernel/hardware configuration
                            • Reads runtime system information
                            PID:1545
                          • /usr/local/sbin/dbus-launch
                            dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                            2⤵
                              PID:1556
                            • /usr/local/bin/dbus-launch
                              dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                              2⤵
                                PID:1556
                              • /usr/sbin/dbus-launch
                                dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                2⤵
                                  PID:1556
                                • /usr/bin/dbus-launch
                                  dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                  2⤵
                                    PID:1556
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 22645 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{8ee15b5a-62d5-402e-b7d4-e26bf746db2c}" 1498 true tab
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    PID:1629
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 22313 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{fcc146f7-572d-4957-ae5a-ef753541beb6}" 1498 true tab
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    PID:1655
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 22662 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{b055b8b5-e1cc-40cf-92fd-7f4e9664f7da}" 1498 true tab
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:1679
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 28662 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{8dfc772d-4f90-4d4e-a223-fd444c6eda4c}" 1498 true tab
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:1697
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -sandboxingKind 0 -prefsLen 29796 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{7f23daa3-01eb-4d34-87e3-b45d21864c11}" 1498 true utility
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:1734
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 27904 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{81592707-0a6e-413b-8616-c587109349f6}" 1498 true tab
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:1735
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -childID 6 -isForBrowser -prefsLen 27904 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{4ef0c64c-c162-495d-97c9-b441d02ddc5a}" 1498 true tab
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:1739
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -childID 7 -isForBrowser -prefsLen 27904 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{fc96b9f0-ac08-4cbb-a6c2-77e0abe3ceb2}" 1498 true tab
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:1748
                                • /usr/libexec/gvfsd-fuse
                                  /usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes
                                  1⤵
                                    PID:1599

                                  Network

                                  MITRE ATT&CK Matrix ATT&CK v13

                                  Defense Evasion

                                  Virtualization/Sandbox Evasion

                                  1
                                  T1497

                                  Discovery

                                  Virtualization/Sandbox Evasion

                                  1
                                  T1497

                                  System Information Discovery

                                  2
                                  T1082

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • /root/.cache/dconf/user
                                    Filesize

                                    2B

                                    MD5

                                    c4103f122d27677c9db144cae1394a66

                                    SHA1

                                    1489f923c4dca729178b3e3233458550d8dddf29

                                    SHA256

                                    96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

                                    SHA512

                                    5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

                                  • /root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0
                                    Filesize

                                    466B

                                    MD5

                                    ab885953ba08f8e4bd49b994e1911d28

                                    SHA1

                                    c66ca0a8b6964c5f14f5d2a29191cdca55a1ad2a

                                    SHA256

                                    f19548074be684190469c4b280ad197032712221d720389c2e47473d83cf0c35

                                    SHA512

                                    456761eba642dfd505a7d4da8863e1d59fc16a1b4193dd391c687be486a060b53d42d1ee4ddcb9c492196b959d1a46aeb3f04cebe31bdf8bb63db188d247bbe4