Analysis Overview
score
6/10
SHA256
dbb270dfa17527ef7f6c02f5edb8896b4d689108aa327f4e9727a3241ade5cee
Threat Level: Shows suspicious behavior
The file 1111 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Reads hardware information
Reads list of loaded kernel modules
Checks mountinfo of local process
Checks CPU configuration
Enumerates kernel/hardware configuration
Reads runtime system information
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-29 14:56
Signatures
N/A
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-29 14:56
Reported
2024-08-29 15:02
Platform
ubuntu2004-amd64-20240729-en
Max time kernel
290s
Max time network
299s
Command Line
[/tmp/1111]
Signatures
Checks mountinfo of local process
| Description | Indicator | Process | Target |
| File opened for reading | /proc/1/mountinfo | /tmp/1111 | N/A |
Reads hardware information
| Description | Indicator | Process | Target |
| File opened for reading | /sys/class/dmi/id/product_uuid | /tmp/1111 | N/A |
Reads list of loaded kernel modules
| Description | Indicator | Process | Target |
| File opened for reading | /proc/modules | /tmp/1111 | N/A |
Checks CPU configuration
| Description | Indicator | Process | Target |
| File opened for reading | /proc/cpuinfo | /tmp/1111 | N/A |
Enumerates kernel/hardware configuration
| Description | Indicator | Process | Target |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/1111 | N/A |
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/1/comm | /tmp/1111 | N/A |
| File opened for reading | /proc/stat | /tmp/1111 | N/A |
| File opened for reading | /proc/bus/pci/devices | /tmp/1111 | N/A |
| File opened for reading | /proc/self/status | /tmp/1111 | N/A |
| File opened for reading | /proc/1/environ | /tmp/1111 | N/A |
| File opened for reading | /proc/self/cgroup | /tmp/1111 | N/A |
| File opened for reading | /proc/filesystems | /tmp/1111 | N/A |
| File opened for reading | /proc/1/stat | /tmp/1111 | N/A |
Processes
/tmp/1111
[/tmp/1111]
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| CN | 47.94.143.163:443 | tcp | |
| US | 1.1.1.1:53 | connectivity-check.ubuntu.com | udp |
| CN | 39.106.13.202:443 | tcp | |
| CN | 47.93.47.186:443 | tcp | |
| CN | 59.110.226.246:443 | tcp | |
| US | 1.1.1.1:53 | 110.0.127.10.in-addr.arpa | udp |
| US | 1.1.1.1:53 | 246.226.110.59.in-addr.arpa | udp |
| CN | 47.94.200.23:443 | tcp | |
| CN | 47.94.143.163:443 | tcp | |
| CN | 39.106.13.202:443 | tcp | |
| CN | 47.93.47.186:443 | tcp | |
| CN | 59.110.226.246:443 | tcp | |
| CN | 47.94.200.23:443 | tcp | |
| CN | 47.94.143.163:443 | tcp | |
| CN | 39.106.13.202:443 | tcp | |
| CN | 47.93.47.186:443 | tcp | |
| US | 1.1.1.1:53 | connectivity-check.ubuntu.com | udp |
| CN | 59.110.226.246:443 | tcp | |
| CN | 47.94.200.23:443 | tcp | |
| CN | 47.94.143.163:443 | tcp | |
| CN | 39.106.13.202:443 | tcp | |
| CN | 47.93.47.186:443 | tcp | |
| US | 1.1.1.1:53 | connectivity-check.ubuntu.com | udp |
| GB | 185.125.190.49:80 | connectivity-check.ubuntu.com | tcp |
| CN | 59.110.226.246:443 | tcp | |
| CN | 47.94.200.23:443 | tcp | |
| CN | 47.94.143.163:443 | tcp | |
| CN | 39.106.13.202:443 | tcp | |
| CN | 47.93.47.186:443 | tcp | |
| CN | 59.110.226.246:443 | tcp | |
| CN | 47.94.200.23:443 | tcp | |
| CN | 47.94.143.163:443 | tcp | |
| CN | 39.106.13.202:443 | tcp | |
| CN | 47.93.47.186:443 | tcp | |
| CN | 59.110.226.246:443 | tcp | |
| CN | 47.94.200.23:443 | tcp |
Files
N/A