Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
12-11-2024 02:40
Behavioral task
behavioral1
Sample
928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf
Resource
ubuntu2204-amd64-20240522.1-en
General
-
Target
928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf
-
Size
60KB
-
MD5
bb82428ecfa3e8da73e8e17da7024716
-
SHA1
8814932fc5637930077f823d9e67601411d196e5
-
SHA256
928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d
-
SHA512
14381d9a600ac1f05fbc7c59d39021c761889bbcfc73d8d0fe90adca204fac647d4288bea475eeb46dfd3be673e0d79b289faaccc27728795fc5f75181939eeb
-
SSDEEP
1536:HlfdBc1C1Eocmq0qWSBN1/wNfTBsebQma:HlE1C1Eo1q0TS31/I+ebt
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elfdescription ioc Process File opened for modification /dev/watchdog 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for modification /dev/misc/watchdog 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 50 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
Processes:
928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elfdescription ioc Process File opened for reading /proc/867/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/990/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/616/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/634/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/636/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/714/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/723/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/863/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/991/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/840/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/608/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/612/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/690/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/699/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/715/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/759/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/971/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/452/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/558/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/664/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/758/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/956/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/962/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/406/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/592/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/635/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/679/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/706/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/729/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/556/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/585/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/632/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/648/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/417/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/593/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/633/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/832/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/842/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/410/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/414/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/512/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/514/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/588/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/658/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/408/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/413/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/427/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/587/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/733/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/983/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf -
Changes its process name 1 IoCs
Processes:
928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elfdescription ioc pid Process Changes the process name, possibly in an attempt to hide itself a 1549 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf -
Processes:
928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elfdescription ioc Process File opened for reading /proc/1172/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1184/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1229/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1259/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1449/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1538/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1553/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1049/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1137/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1190/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1203/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1260/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1526/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1173/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1041/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1146/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1166/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1198/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1318/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1374/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1204/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1233/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1036/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1148/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1271/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1053/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1069/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1085/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1180/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1267/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1113/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1116/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1163/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1305/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1554/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1161/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1436/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1016/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1169/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1080/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1174/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1238/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1268/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1074/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1178/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1200/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1241/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1375/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1432/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1058/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1087/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1122/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1162/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1189/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1408/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1102/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1371/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1099/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1179/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1343/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1537/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1551/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf File opened for reading /proc/1558/maps 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf