Malware Analysis Report

2024-12-07 17:30

Sample ID 241112-cxjtcawjcj
Target 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf
SHA256 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68
Tags
credential_access defense_evasion mirai
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68

Threat Level: Known bad

The file 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf was found to be: Known bad.

Malicious Activity Summary

credential_access defense_evasion mirai

Mirai family

Modifies Watchdog functionality

Enumerates running processes

Reads process memory

Changes its process name

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 02:27

Signatures

Mirai family

mirai

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 02:27

Reported

2024-11-12 02:29

Platform

debian9-armhf-20240418-en

Max time kernel

149s

Max time network

147s

Command Line

[/tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf]

Signatures

Modifies Watchdog functionality

defense_evasion
Description Indicator Process Target
File opened for modification /dev/misc/watchdog /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for modification /dev/watchdog /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A

Enumerates running processes

Reads process memory

credential_access
Description Indicator Process Target
File opened for reading /proc/572/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/635/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/637/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/640/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/702/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/711/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/636/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/664/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/764/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/758/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/762/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/588/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/593/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/706/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/748/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/755/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/768/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/774/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/592/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/630/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/649/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/590/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/750/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/760/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/766/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/772/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/776/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/642/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/757/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A
File opened for reading /proc/770/maps /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A

Changes its process name

Description Indicator Process Target
Changes the process name, possibly in an attempt to hide itself a /tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf N/A

Processes

/tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf

[/tmp/66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf]

Network

Country Destination Domain Proto
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 193.84.71.119:38241 tcp

Files

N/A