Analysis
-
max time kernel
149s -
max time network
134s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
03-05-2024 02:42
Behavioral task
behavioral1
Sample
1539-1-0x0000000000400000-0x000000000060e700-memory.dmp
Resource
ubuntu2004-amd64-20240221-en
General
-
Target
1539-1-0x0000000000400000-0x000000000060e700-memory.dmp
-
Size
54KB
-
MD5
aba77cdbbb792ac8cf8758f27e528dba
-
SHA1
344c9d943c6a15547615e904458dd8bfc7ca94c0
-
SHA256
8b174cbd2b2dbcec492bab7938547c575e43d79a0f55aeb83773d881768b8e1e
-
SHA512
4288c86e1275489b0ebf88d2bde78f6434eb09d6de212116e527f8c5a21b918c1ff90c5b30c88f336f75a3d91dfc567b1e1e74d383066de2098c70ca8d1ab47b
-
SSDEEP
1536:7zm4N5hpp6TIuk/nCyUnThJy9UZRLDHTW:24HcT60u9U73zW
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
1539-1-0x0000000000400000-0x000000000060e700-memory.dmpdescription ioc process File opened for modification /dev/watchdog 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for modification /dev/misc/watchdog 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
1539-1-0x0000000000400000-0x000000000060e700-memory.dmpdescription ioc process File opened for modification /sbin/watchdog 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for modification /bin/watchdog 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
1539-1-0x0000000000400000-0x000000000060e700-memory.dmpdescription ioc process File opened for reading /proc/507/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/981/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1970/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/617/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/678/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/808/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1518/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/958/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1157/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1895/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/503/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/912/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1040/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1103/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/448/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/586/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1143/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1237/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1508/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1519/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/497/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/783/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/949/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1004/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1423/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1706/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/540/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1044/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1098/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1411/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/553/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/698/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/910/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1030/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1522/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/641/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/814/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1052/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1172/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1418/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/2083/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/494/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/519/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1409/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1551/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1936/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1099/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1118/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/2007/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/618/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/766/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/566/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/694/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/991/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1141/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/459/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/637/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/856/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1035/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1048/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1410/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1764/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/1937/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp File opened for reading /proc/569/cmdline 1539-1-0x0000000000400000-0x000000000060e700-memory.dmp