Analysis
- max time kernel
149s - max time network
153s - platform
ubuntu-20.04_amd64 - resource
ubuntu2004-amd64-20240611-en - resource tags
- submitted
02/11/2024, 15:47
General
- Target https://github.com/un1cum/Beast_Bomber
- Sample241102-s792aa1nfq
Score
4/10
Malware Config
Signatures
- Changes its process name 64 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 12 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Information Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the system, such as OS, hostname, and hardware details.
- Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/usr/bin/xdg-openxdg-open https://github.com/un1cum/Beast_Bomber1⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
-
/usr/bin/dbus-launchdbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Reads runtime system information
-
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Changes its process name
- Reads runtime system information
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Changes its process name
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
-
/usr/libexec/gvfsd-trash/usr/libexec/gvfsd-trash --spawner :1.8 /org/gtk/gvfs/exec_spaw/06⤵
- Reads runtime system information
-
-
-
/usr/libexec/dconf-service/usr/libexec/dconf-service5⤵
- Reads runtime system information
-
-
/usr/bin/nautilus/usr/bin/nautilus --gapplication-service5⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵
- Reads runtime system information
-
-
/usr/libexec/gvfs-udisks2-volume-monitor/usr/libexec/gvfs-udisks2-volume-monitor5⤵
- Reads runtime system information
-
-
/usr/libexec/gvfs-afc-volume-monitor/usr/libexec/gvfs-afc-volume-monitor5⤵
- Reads runtime system information
-
-
/usr/libexec/gvfs-mtp-volume-monitor/usr/libexec/gvfs-mtp-volume-monitor5⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/libexec/gvfs-gphoto2-volume-monitor/usr/libexec/gvfs-gphoto2-volume-monitor5⤵
- Enumerates kernel/hardware configuration
-
-
/usr/libexec/gvfs-goa-volume-monitor/usr/libexec/gvfs-goa-volume-monitor5⤵
- Reads runtime system information
-
-
/usr/libexec/goa-daemon/usr/libexec/goa-daemon5⤵
-
-
/usr/libexec/goa-identity-service/usr/libexec/goa-identity-service5⤵
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
-
-
/usr/bin/xpropxprop -root2⤵
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
-
-
/usr/bin/unameuname2⤵
-
-
/usr/bin/grepgrep -q "^file://"2⤵
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
-
/usr/bin/dbus-launchdbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr4⤵
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
-
-
/usr/bin/xpropxprop -root3⤵
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
-
-
/usr/bin/unameuname3⤵
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/whichwhich firefox2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/firefox/usr/bin/firefox https://github.com/un1cum/Beast_Bomber2⤵
-
/usr/bin/whichwhich /usr/bin/firefox3⤵
-
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox https://github.com/un1cum/Beast_Bomber2⤵
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 133⤵
- Changes its process name
- Enumerates kernel/hardware configuration
-
-
/usr/bin/lsb_release/usr/bin/lsb_release -idrc3⤵
- System Information Discovery
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20597 -prefMapSize 234708 -appDir /usr/lib/firefox/browser "{5ca5ae48-e1b4-4d37-886e-ec4c73f0a699}" 1497 true socket3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 20271 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{a6b62602-72a7-4f69-aa6e-ec2458ce5140}" 1497 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 26979 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{6c3048ed-3d90-4fb7-b090-e35874776f48}" 1497 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -sandboxingKind 0 -prefsLen 28033 -prefMapSize 234708 -appDir /usr/lib/firefox/browser "{073a4f1f-ee6c-4cc0-8b15-2a36b272a23d}" 1497 true utility3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 27124 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{d0b448e3-7811-4f26-92d2-bb045727b5a2}" 1497 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27178 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{bd2e5ec2-d1e3-4aa7-8c65-4d98da9db471}" 1497 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 27178 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{c8b4da19-00b2-489f-a804-936176df2f39}" 1497 true tab3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
user
tmpaddon