12c9b376e774627c69ab50ee9f3b31ab6bf3cf752fb3751a931ede695d3b066e

General

Target

1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
Size

64KB
MD5

798466c0bca7f4685da26a6e6ca84e9a
SHA1

788fa6d54e2bfa071cfa3d12ee32c10f42685a0a
SHA256

12c9b376e774627c69ab50ee9f3b31ab6bf3cf752fb3751a931ede695d3b066e
SHA512

d37d268ae9044b661d05c2895e63a16fcfadeed9998487b0cee845ba3a8748b6dbd44c211dcddb408794c01baab22f79f58db12528413bee6a55c985ba350aad
SSDEEP

1536:JRMw6aLO8KDLABUA8MjsILKNYIY2I9hyG7SbAW0Uwo:JRMZaLtKDLaUzastNYIc9hyG70ozo

Score

7^/10

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp

description	ioc	process
File opened for modification	/dev/watchdog	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for modification	/dev/misc/watchdog	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

Processes:

1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp

description	ioc	process
File opened for modification	/bin/watchdog	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for modification	/sbin/watchdog	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp

description	ioc	process
File opened for reading	/proc/900/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1405/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1030/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/491/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/497/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/516/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/572/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/483/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/616/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1038/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1119/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/614/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1478/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/482/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/672/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/922/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1109/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1136/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/443/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/895/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/984/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1051/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1409/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/495/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/964/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1125/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1113/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1411/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1034/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1079/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1530/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1101/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1410/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1947/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/523/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/537/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/798/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1020/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/578/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/825/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1148/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1413/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1420/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/638/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/670/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/967/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1077/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1439/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/498/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/800/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1075/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1414/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1080/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1519/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/640/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/687/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/896/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1076/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/759/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1492/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1902/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/988/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1025/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
File opened for reading	/proc/1412/cmdline	1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp

/tmp/1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
/tmp/1544-1-0x0000000000400000-0x0000000000612cb8-memory.dmp
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1527