Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
12-11-2024 02:53
Behavioral task
behavioral1
Sample
c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf
Resource
ubuntu1804-amd64-20240611-en
General
-
Target
c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf
-
Size
53KB
-
MD5
72421558fceebe610a98a0862c9a1e6f
-
SHA1
a73e6a9e98cdbe4c017ec1af46ef668efd971ab7
-
SHA256
c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93
-
SHA512
fd3752ed2e2abd7ceb22b843ef1940b722b91ecd8a909936f611c59e1de120ace0004da795cc43919a7ae2d1195921a0784420bacde1d08b8e08464e7906b1e5
-
SSDEEP
1536:B9y2V3mnZdLRFv2vtIuqYi2rRW1AidRa:+2FEZdLWvtRNV1WG2E
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elfdescription ioc Process File opened for modification /dev/watchdog c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for modification /dev/misc/watchdog c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 38 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
Processes:
c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elfdescription ioc Process File opened for reading /proc/604/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/605/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/445/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/454/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/636/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/683/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/467/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/517/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/679/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/710/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/954/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/970/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/435/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/482/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/582/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/717/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/886/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/959/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/518/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/539/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/558/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/652/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/713/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/964/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/426/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/545/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/953/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/459/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/469/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/655/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/668/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/439/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/473/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/453/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/460/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/470/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/419/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/448/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf -
Changes its process name 1 IoCs
Processes:
c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elfdescription ioc pid Process Changes the process name, possibly in an attempt to hide itself a 1484 c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf -
Processes:
c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elfdescription ioc Process File opened for reading /proc/1023/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1063/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1154/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1359/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1488/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1014/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1151/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1100/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1091/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1124/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1169/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1256/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1344/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1087/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1118/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1137/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1222/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1242/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1492/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1073/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1253/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1289/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1189/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1481/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1489/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1191/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1164/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1141/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1067/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1111/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1133/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1155/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1196/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1343/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1049/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1186/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1193/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1479/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1482/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1166/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1177/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1270/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1290/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1332/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1376/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1080/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1298/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1149/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1172/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1486/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1146/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1070/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1129/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1160/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1182/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1187/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1306/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1322/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf File opened for reading /proc/1043/maps c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf