Malware Analysis Report

2024-11-13 18:03

Sample ID 241109-ec7qsazken
Target de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf
SHA256 de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b
Tags
upx mirai lzrd botnet defense_evasion discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b

Threat Level: Known bad

The file de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf was found to be: Known bad.

Malicious Activity Summary

upx mirai lzrd botnet defense_evasion discovery

Mirai

Mirai family

Modifies Watchdog functionality

Enumerates running processes

Writes file to system bin folder

UPX packed file

Reads runtime system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 03:48

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 03:48

Reported

2024-11-09 03:51

Platform

ubuntu2204-amd64-20240611-en

Max time kernel

135s

Max time network

146s

Command Line

[/tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf]

Signatures

Mirai

botnet mirai

Mirai family

mirai

Modifies Watchdog functionality

defense_evasion
Description Indicator Process Target
File opened for modification /dev/watchdog /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for modification /dev/misc/watchdog /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A

Enumerates running processes

Writes file to system bin folder

Description Indicator Process Target
File opened for modification /sbin/watchdog /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for modification /bin/watchdog /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/94/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/314/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/413/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/610/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/809/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/994/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1037/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1157/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1184/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/92/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/377/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/742/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/966/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1032/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1532/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/21/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/732/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/79/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1162/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1163/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/75/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/607/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1043/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1161/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1554/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/19/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/26/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/935/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1156/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1192/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1199/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1362/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/7/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/27/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/82/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/99/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1107/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/14/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/80/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/95/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/788/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/946/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1132/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/15/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/88/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/226/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/428/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/636/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/783/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1053/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1282/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1318/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/85/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/98/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/679/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1083/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1164/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1168/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1230/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/22/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/91/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/160/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/635/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A
File opened for reading /proc/1052/status /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf N/A

Processes

/tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf

[/tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 198.12.107.126:3778 tcp
US 198.12.107.126:3778 tcp

Files

memory/1565-1-0x0000000008048000-0x000000000805cc40-memory.dmp