Analysis
-
max time kernel
149s -
max time network
131s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
29-04-2024 01:27
General
-
Target
df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf
-
Size
20KB
-
MD5
788ad2ffa9f903e010b2030190f09866
-
SHA1
86e48447bbde69b07354ddb1149a6b1ca52afd59
-
SHA256
df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10
-
SHA512
2f56cff17b678378f81f3cc0cc15ac66bf438b1fcf21acb178c70aea3ebf5025737877315a866ad08f9caf8a769af4ebb8d3c7e7b1dac3f74a2db56cd7c785c7
-
SSDEEP
384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTH:x98o08kxofBE+ZkXaITbp2F2TWul0c57
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elfdescription ioc process File opened for modification /dev/watchdog df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for modification /dev/misc/watchdog df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elfdescription ioc process File opened for modification /sbin/watchdog df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for modification /bin/watchdog df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elfdescription ioc process File opened for reading /proc/564/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/618/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/802/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/829/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1415/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1743/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/858/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1083/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/482/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/496/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/538/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/568/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/691/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/785/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/498/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/804/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1001/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1453/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/446/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/695/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/949/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1532/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/445/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/535/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1081/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1419/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1492/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1038/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1042/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1257/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1315/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1421/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1424/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1467/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1472/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/442/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/635/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1115/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1188/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1418/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1429/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/484/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/810/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/967/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1024/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1131/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/2104/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/674/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/981/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1128/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1430/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/440/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1416/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1530/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1046/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/497/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/521/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/588/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/866/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/972/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1079/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/636/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/763/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf File opened for reading /proc/1082/cmdline df015ade97f1e4e20d7cbeea972e34873b8a31818c58ac6a219181a3a8ebbb10.elf
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1489-1-0x0000000008048000-0x00000000080547a0-memory.dmp