c01b1e7fdd3f14fd99523c71da4ce97497b4262065a6f29d9251b26cab7e03bb

Analysis

max time kernel
150s
max time network
156s
platform
debian-12_armhf
resource
debian12-armhf-20240729-en
resource tags

arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
25-09-2024 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56618521379097511
Size

191KB
MD5

1e93874a2e62119775e545c413b6c168
SHA1

33e471c1622ef34d4d3e681a570af22b4a17bd19
SHA256

2d894d197ce20ac34f74d35eafb11605efc3dc6ea286dd6c1a2f3542bf75db21
SHA512

7f8b606aff6319104392436628485365cf2de94b9dcddca5dc0c596120a1b46ea3ceea8a903f8b0e027e457b6f79dd8125e11108390c6fe25dace28dd5c939d3
SSDEEP

3072:K+Ag8mGa4ybxHot+ykaTs/eNBHONTEfIg6tLUbt8k8iKkoEM/9y2VLXmFj35VTK:K+ZQapl5aTs/eNBHOREEypKkrM/9y2RT

Score

7^/10

credential_access defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
defense_evasion

Impair Defenses
T1562

Processes:

56618521379097511

description ioc process

File opened for modification /dev/watchdog 56618521379097511
File opened for modification /dev/misc/watchdog 56618521379097511

description	ioc	process
File opened for modification	/dev/watchdog	56618521379097511
File opened for modification	/dev/misc/watchdog	56618521379097511

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195

Enumerates running processes
Discovers information about currently running processes on the system

Reads process memory 1 TTPs 64 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

Processes:

56618521379097511

description	ioc	process
File opened for reading	/proc/798/maps	56618521379097511
File opened for reading	/proc/965/maps	56618521379097511
File opened for reading	/proc/934/maps	56618521379097511
File opened for reading	/proc/961/maps	56618521379097511
File opened for reading	/proc/875/maps	56618521379097511
File opened for reading	/proc/877/maps	56618521379097511
File opened for reading	/proc/878/maps	56618521379097511
File opened for reading	/proc/884/maps	56618521379097511
File opened for reading	/proc/886/maps	56618521379097511
File opened for reading	/proc/761/maps	56618521379097511
File opened for reading	/proc/776/maps	56618521379097511
File opened for reading	/proc/822/maps	56618521379097511
File opened for reading	/proc/994/maps	56618521379097511
File opened for reading	/proc/891/maps	56618521379097511
File opened for reading	/proc/898/maps	56618521379097511
File opened for reading	/proc/911/maps	56618521379097511
File opened for reading	/proc/984/maps	56618521379097511
File opened for reading	/proc/814/maps	56618521379097511
File opened for reading	/proc/887/maps	56618521379097511
File opened for reading	/proc/981/maps	56618521379097511
File opened for reading	/proc/903/maps	56618521379097511
File opened for reading	/proc/943/maps	56618521379097511
File opened for reading	/proc/950/maps	56618521379097511
File opened for reading	/proc/958/maps	56618521379097511
File opened for reading	/proc/775/maps	56618521379097511
File opened for reading	/proc/783/maps	56618521379097511
File opened for reading	/proc/837/maps	56618521379097511
File opened for reading	/proc/894/maps	56618521379097511
File opened for reading	/proc/930/maps	56618521379097511
File opened for reading	/proc/954/maps	56618521379097511
File opened for reading	/proc/362/maps	56618521379097511
File opened for reading	/proc/857/maps	56618521379097511
File opened for reading	/proc/917/maps	56618521379097511
File opened for reading	/proc/977/maps	56618521379097511
File opened for reading	/proc/850/maps	56618521379097511
File opened for reading	/proc/867/maps	56618521379097511
File opened for reading	/proc/895/maps	56618521379097511
File opened for reading	/proc/892/maps	56618521379097511
File opened for reading	/proc/951/maps	56618521379097511
File opened for reading	/proc/653/maps	56618521379097511
File opened for reading	/proc/823/maps	56618521379097511
File opened for reading	/proc/880/maps	56618521379097511
File opened for reading	/proc/873/maps	56618521379097511
File opened for reading	/proc/920/maps	56618521379097511
File opened for reading	/proc/960/maps	56618521379097511
File opened for reading	/proc/324/maps	56618521379097511
File opened for reading	/proc/666/maps	56618521379097511
File opened for reading	/proc/871/maps	56618521379097511
File opened for reading	/proc/899/maps	56618521379097511
File opened for reading	/proc/929/maps	56618521379097511
File opened for reading	/proc/932/maps	56618521379097511
File opened for reading	/proc/969/maps	56618521379097511
File opened for reading	/proc/780/maps	56618521379097511
File opened for reading	/proc/832/maps	56618521379097511
File opened for reading	/proc/888/maps	56618521379097511
File opened for reading	/proc/861/maps	56618521379097511
File opened for reading	/proc/879/maps	56618521379097511
File opened for reading	/proc/902/maps	56618521379097511
File opened for reading	/proc/919/maps	56618521379097511
File opened for reading	/proc/982/maps	56618521379097511
File opened for reading	/proc/799/maps	56618521379097511
File opened for reading	/proc/803/maps	56618521379097511
File opened for reading	/proc/834/maps	56618521379097511
File opened for reading	/proc/985/maps	56618521379097511

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

56618521379097511

description	ioc	process
File opened for reading	/proc/1045/cmdline	56618521379097511
File opened for reading	/proc/1537/cmdline	56618521379097511
File opened for reading	/proc/2709/maps	56618521379097511
File opened for reading	/proc/3459/fd	56618521379097511
File opened for reading	/proc/1325/maps	56618521379097511
File opened for reading	/proc/2743/maps	56618521379097511
File opened for reading	/proc/3154/cmdline	56618521379097511
File opened for reading	/proc/4655/cmdline	56618521379097511
File opened for reading	/proc/1260/maps	56618521379097511
File opened for reading	/proc/1364/maps	56618521379097511
File opened for reading	/proc/1584/cmdline	56618521379097511
File opened for reading	/proc/3069/maps	56618521379097511
File opened for reading	/proc/3082/fd	56618521379097511
File opened for reading	/proc/3434/cmdline	56618521379097511
File opened for reading	/proc/4289/maps	56618521379097511
File opened for reading	/proc/4348/fd	56618521379097511
File opened for reading	/proc/4386/maps	56618521379097511
File opened for reading	/proc/915/fd	56618521379097511
File opened for reading	/proc/970/cmdline	56618521379097511
File opened for reading	/proc/1171/maps	56618521379097511
File opened for reading	/proc/3346/cmdline	56618521379097511
File opened for reading	/proc/4490/maps	56618521379097511
File opened for reading	/proc/1630/cmdline	56618521379097511
File opened for reading	/proc/1751/fd	56618521379097511
File opened for reading	/proc/1818/maps	56618521379097511
File opened for reading	/proc/2201/cmdline	56618521379097511
File opened for reading	/proc/2271/cmdline	56618521379097511
File opened for reading	/proc/2564/maps	56618521379097511
File opened for reading	/proc/2573/cmdline	56618521379097511
File opened for reading	/proc/3208/cmdline	56618521379097511
File opened for reading	/proc/4156/cmdline	56618521379097511
File opened for reading	/proc/1458/cmdline	56618521379097511
File opened for reading	/proc/1890/fd	56618521379097511
File opened for reading	/proc/2381/maps	56618521379097511
File opened for reading	/proc/3314/maps	56618521379097511
File opened for reading	/proc/3499/maps	56618521379097511
File opened for reading	/proc/3716/fd	56618521379097511
File opened for reading	/proc/1362/cmdline	56618521379097511
File opened for reading	/proc/1645/fd	56618521379097511
File opened for reading	/proc/2849/maps	56618521379097511
File opened for reading	/proc/2893/fd	56618521379097511
File opened for reading	/proc/3654/maps	56618521379097511
File opened for reading	/proc/3715/cmdline	56618521379097511
File opened for reading	/proc/3889/fd	56618521379097511
File opened for reading	/proc/4255/maps	56618521379097511
File opened for reading	/proc/2038/maps	56618521379097511
File opened for reading	/proc/2794/cmdline	56618521379097511
File opened for reading	/proc/4387/cmdline	56618521379097511
File opened for reading	/proc/2073/maps	56618521379097511
File opened for reading	/proc/2406/cmdline	56618521379097511
File opened for reading	/proc/3153/fd	56618521379097511
File opened for reading	/proc/3215/fd	56618521379097511
File opened for reading	/proc/4130/maps	56618521379097511
File opened for reading	/proc/1719/fd	56618521379097511
File opened for reading	/proc/1915/cmdline	56618521379097511
File opened for reading	/proc/2190/fd	56618521379097511
File opened for reading	/proc/2662/fd	56618521379097511
File opened for reading	/proc/2762/fd	56618521379097511
File opened for reading	/proc/3113/cmdline	56618521379097511
File opened for reading	/proc/3529/maps	56618521379097511
File opened for reading	/proc/3786/fd	56618521379097511
File opened for reading	/proc/778/cmdline	56618521379097511
File opened for reading	/proc/1325/fd	56618521379097511
File opened for reading	/proc/2253/cmdline	56618521379097511

/tmp/56618521379097511
/tmp/56618521379097511
1⤵
- Modifies Watchdog functionality
- Reads process memory
- Reads runtime system information
PID:758

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads