Malware Analysis Report

2024-12-07 17:30

Sample ID 241112-c5837sshre
Target 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf
SHA256 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d
Tags
mirai credential_access defense_evasion discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d

Threat Level: Known bad

The file 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf was found to be: Known bad.

Malicious Activity Summary

mirai credential_access defense_evasion discovery

Mirai family

Modifies Watchdog functionality

Enumerates running processes

Reads process memory

Changes its process name

Reads runtime system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 02:40

Signatures

Mirai family

mirai

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 02:40

Reported

2024-11-12 02:43

Platform

ubuntu2204-amd64-20240522.1-en

Max time kernel

149s

Max time network

150s

Command Line

[/tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf]

Signatures

Modifies Watchdog functionality

defense_evasion
Description Indicator Process Target
File opened for modification /dev/watchdog /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for modification /dev/misc/watchdog /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A

Enumerates running processes

Reads process memory

credential_access
Description Indicator Process Target
File opened for reading /proc/867/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/990/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/616/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/634/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/636/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/714/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/723/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/863/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/991/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/840/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/608/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/612/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/690/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/699/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/715/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/759/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/971/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/452/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/558/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/664/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/758/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/956/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/962/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/406/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/592/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/635/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/679/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/706/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/729/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/556/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/585/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/632/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/648/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/417/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/593/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/633/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/832/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/842/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/410/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/414/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/512/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/514/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/588/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/658/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/408/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/413/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/427/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/587/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/733/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/983/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A

Changes its process name

Description Indicator Process Target
Changes the process name, possibly in an attempt to hide itself a /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/1172/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1184/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1229/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1259/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1449/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1538/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1553/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1049/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1137/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1190/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1203/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1260/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1526/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1173/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1041/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1146/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1166/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1198/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1318/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1374/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1204/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1233/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1036/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1148/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1271/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1053/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1069/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1085/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1180/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1267/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1113/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1116/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1163/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1305/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1554/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1161/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1436/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1016/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1169/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1080/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1174/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1238/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1268/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1074/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1178/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1200/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1241/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1375/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1432/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1058/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1087/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1122/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1162/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1189/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1408/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1102/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1371/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1099/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1179/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1343/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1537/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1551/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1558/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A

Processes

/tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf

[/tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 193.84.71.119:38241 tcp

Files

N/A