Analysis
-
max time kernel
149s -
max time network
147s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
12-11-2024 02:20
Static task
static1
Behavioral task
behavioral1
Sample
4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf
Resource
ubuntu2204-amd64-20240611-en
General
-
Target
4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf
-
Size
60KB
-
MD5
3466cbc89e9e6eb9f99c812a56838b23
-
SHA1
089144eefb83c0974e0563f21498e003d1e52679
-
SHA256
4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767
-
SHA512
b62e1e3db41bf29e92975dac5dc18ebb08fccfbe6d56aa6f68c03ba0ddbffe9953bb5a61e41442cf8e1bbe753a8c5b99cb8b2c47baba242a45a3f144f47a78d0
-
SSDEEP
768:O44x7YY0/Z6u8f2oFdFRiF0So3q/R2s2ffSfAL9ZTXJ4YJtnw9hhtSTbhGJec15o:O4CBf2oFdOF0So1XtItSyp5vA
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elfdescription ioc Process File opened for modification /dev/watchdog 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for modification /dev/misc/watchdog 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 51 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
Processes:
4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elfdescription ioc Process File opened for reading /proc/805/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/536/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/588/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/614/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/635/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/637/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/775/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/417/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/586/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/788/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/741/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/951/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/427/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/506/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/589/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/594/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/634/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/713/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/406/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/416/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/508/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/747/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/762/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/809/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/963/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/636/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/663/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/740/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/774/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/783/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/923/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/452/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/533/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/732/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/760/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/971/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/640/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/769/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/970/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/676/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/682/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/410/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/412/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/414/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/590/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/609/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/612/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/736/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/790/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/929/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/993/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf -
Changes its process name 1 IoCs
Processes:
4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elfdescription ioc pid Process Changes the process name, possibly in an attempt to hide itself a 1565 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf -
Processes:
4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elfdescription ioc Process File opened for reading /proc/1157/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1108/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1358/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1411/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1072/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1280/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1554/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1570/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1061/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1367/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1424/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1144/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1158/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1164/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1433/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1447/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1526/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1052/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1124/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1190/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1140/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1421/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1102/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1159/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1232/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1037/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1174/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1486/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1131/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1162/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1223/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1247/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1293/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1349/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1032/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1172/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1240/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1569/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1155/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1156/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1163/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1204/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1286/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1088/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1096/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1161/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1189/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1207/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1567/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1053/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1104/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1160/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1191/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1553/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1346/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1043/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1080/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1082/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1167/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1326/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1341/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf File opened for reading /proc/1230/maps 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf