Malware Analysis Report

2024-12-07 17:30

Sample ID 241112-csnazasfjb
Target 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf
SHA256 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767
Tags
credential_access defense_evasion discovery
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767

Threat Level: Shows suspicious behavior

The file 4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf was found to be: Shows suspicious behavior.

Malicious Activity Summary

credential_access defense_evasion discovery

Modifies Watchdog functionality

Enumerates running processes

Reads process memory

Changes its process name

Reads runtime system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 02:20

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 02:20

Reported

2024-11-12 02:23

Platform

ubuntu2204-amd64-20240611-en

Max time kernel

149s

Max time network

147s

Command Line

[/tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf]

Signatures

Modifies Watchdog functionality

defense_evasion
Description Indicator Process Target
File opened for modification /dev/watchdog /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for modification /dev/misc/watchdog /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A

Enumerates running processes

Reads process memory

credential_access
Description Indicator Process Target
File opened for reading /proc/805/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/536/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/588/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/614/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/635/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/637/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/775/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/417/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/586/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/788/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/741/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/951/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/427/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/506/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/589/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/594/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/634/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/713/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/406/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/416/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/508/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/747/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/762/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/809/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/963/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/636/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/663/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/740/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/774/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/783/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/923/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/452/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/533/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/732/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/760/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/971/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/640/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/769/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/970/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/676/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/682/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/410/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/412/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/414/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/590/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/609/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/612/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/736/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/790/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/929/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/993/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A

Changes its process name

Description Indicator Process Target
Changes the process name, possibly in an attempt to hide itself a /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/1157/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1108/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1358/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1411/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1072/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1280/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1554/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1570/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1061/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1367/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1424/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1144/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1158/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1164/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1433/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1447/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1526/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1052/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1124/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1190/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1140/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1421/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1102/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1159/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1232/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1037/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1174/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1486/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1131/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1162/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1223/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1247/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1293/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1349/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1032/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1172/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1240/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1569/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1155/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1156/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1163/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1204/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1286/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1088/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1096/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1161/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1189/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1207/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1567/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1053/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1104/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1160/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1191/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1553/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1346/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1043/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1080/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1082/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1167/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1326/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1341/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A
File opened for reading /proc/1230/maps /tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf N/A

Processes

/tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf

[/tmp/4ed362103fa27a8618955696b657c80cb5f1491b282cca11ee28ef966d1a1767.elf]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 193.84.71.119:38241 tcp

Files

N/A