Overview

overview

10

Static

static

1

ad09939a99...2c.elf

ubuntu-20.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    05/11/2024, 15:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ad09939a999ace146e122de0082bbf2a3c3d64aedaf844421ba21276b1280b2c.elf
  • Size 8.7MB
  • Sample241105-s75fsswpdq
  • SHA256 ad09939a999ace146e122de0082bbf2a3c3d64aedaf844421ba21276b1280b2c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xmrigxmrig_linuxantivmcredential_accessdefense_evasiondiscoveryevasionminerprivilege_escalation

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • Xmrig family
    xmrig
  • Xmrig_linux family
    xmrig_linux
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Executes dropped EXE 29 IoCs
  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • OS Credential Dumping 1 TTPs 30 IoCs

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access
  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 30 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Checks hardware identifiers (DMI) 1 TTPs 64 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads hardware information 1 TTPs 64 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Reads list of loaded kernel modules 1 TTPs 1 IoCs

    Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    evasion
  • Checks CPU configuration 1 TTPs 30 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 64 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ad09939a999ace146e122de0082bbf2a3c3d64aedaf844421ba21276b1280b2c.elf
    /tmp/ad09939a999ace146e122de0082bbf2a3c3d64aedaf844421ba21276b1280b2c.elf
    1⤵
    • Modifies hosts file
    • Reads list of loaded kernel modules
    • Checks CPU configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1395
    • /usr/bin/sudo
      sudo -n true
      2⤵
      • OS Credential Dumping
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      PID:1444
      • /usr/bin/true
        true
        3⤵
          PID:1445
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1446
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          PID:1447
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1468
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1469
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1475
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1476
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        • Reads runtime system information
        PID:1483
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1484
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        • Reads runtime system information
        PID:1490
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1491
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1515
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1516
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        • Reads runtime system information
        PID:1522
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1523
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1530
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1531
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1537
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1538
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1544
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1545
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1551
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1552
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1560
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Enumerates kernel/hardware configuration
          PID:1561
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1567
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1568
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1574
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1575
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1581
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1582
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1588
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1589
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1595
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1596
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1602
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1603
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1609
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1610
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1616
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1617
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1623
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1624
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1630
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1631
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        • Reads runtime system information
        PID:1637
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1638
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        • Reads runtime system information
        PID:1645
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          PID:1646
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1652
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1653
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1659
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1660
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1666
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1667
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1673
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1674
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        • Reads runtime system information
        PID:1680
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Enumerates kernel/hardware configuration
          PID:1681

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          config.json
          • Path /tmp/xmrig/xmrig-6.22.0/config.json
          • Size 4KB
          • SHA256 fa70f1a297f3ed7d2ef75598d4a1da3fb82d68fc14322fdcc0f29c909882a599
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          config.json
          • Path /tmp/xmrig/xmrig-6.22.0/config.json
          • Size 4KB
          • SHA256 dc562084726d67bb85ba291436d3dd49cd7474d9a238000adbab38937fc37a3a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          xmrig
          • Path /tmp/xmrig/xmrig-6.22.0/xmrig
          • Size 9.0MB
          • SHA256 0d861bf1eafe3cd5d47197b2def17efb6853f2d0a5a46cafb289c013c449b33b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download