Analysis
-
max time kernel
149s -
max time network
128s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
06-05-2024 23:24
Behavioral task
behavioral1
Sample
1547-1-0x0000000008048000-0x0000000008059830-memory.dmp
Resource
ubuntu1804-amd64-20240226-en
General
-
Target
1547-1-0x0000000008048000-0x0000000008059830-memory.dmp
-
Size
57KB
-
MD5
daafbb5529958f0c40510d7707e5afc4
-
SHA1
044a881b04bc088ac555447c8438f34260fddb51
-
SHA256
57354b5fd8754acd89131116d20b2841f2b20bedfc1d8e5c8ca2ced57d7ee4bd
-
SHA512
a347cfa60af91f0fd88c23f942c868a719e0a05998a0b092cba7129bbfc5553dc8b3185172cebb3347233d0f197f6748495376f6e233330929722d465934f78e
-
SSDEEP
1536:X1gao25TBFulRcpFZMkAGslEhUZxuBBFNbQc7:FgaoMTB+RP52UYzh
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
1547-1-0x0000000008048000-0x0000000008059830-memory.dmpdescription ioc process File opened for modification /dev/misc/watchdog 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for modification /dev/watchdog 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
1547-1-0x0000000008048000-0x0000000008059830-memory.dmpdescription ioc process File opened for modification /bin/watchdog 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for modification /sbin/watchdog 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
1547-1-0x0000000008048000-0x0000000008059830-memory.dmpdescription ioc process File opened for reading /proc/1124/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1155/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/971/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1283/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/445/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1184/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/544/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1177/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1544/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1642/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1648/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/660/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1024/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1255/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1352/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1153/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1397/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1600/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/563/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/958/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/972/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1325/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/504/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1541/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1586/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/419/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/507/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/968/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1580/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1198/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1244/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/655/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/683/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/709/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1179/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1559/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/678/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1044/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1163/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1480/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1128/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1331/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1636/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1259/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/607/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/663/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1132/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1161/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1266/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/487/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/579/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1144/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1158/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1654/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1038/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1077/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1173/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1630/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1310/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/459/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/479/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/527/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/1301/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp File opened for reading /proc/455/cmdline 1547-1-0x0000000008048000-0x0000000008059830-memory.dmp