Malware Analysis Report

2024-12-07 17:30

Sample ID 241112-ddntmasldy
Target c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf
SHA256 c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93
Tags
mirai credential_access defense_evasion discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93

Threat Level: Known bad

The file c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf was found to be: Known bad.

Malicious Activity Summary

mirai credential_access defense_evasion discovery

Mirai family

Modifies Watchdog functionality

Enumerates running processes

Reads process memory

Changes its process name

Reads runtime system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 02:53

Signatures

Mirai family

mirai

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 02:53

Reported

2024-11-12 02:56

Platform

ubuntu1804-amd64-20240611-en

Max time kernel

149s

Max time network

149s

Command Line

[/tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf]

Signatures

Modifies Watchdog functionality

defense_evasion
Description Indicator Process Target
File opened for modification /dev/watchdog /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for modification /dev/misc/watchdog /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A

Enumerates running processes

Reads process memory

credential_access
Description Indicator Process Target
File opened for reading /proc/604/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/605/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/445/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/454/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/636/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/683/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/467/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/517/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/679/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/710/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/954/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/970/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/435/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/482/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/582/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/717/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/886/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/959/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/518/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/539/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/558/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/652/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/713/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/964/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/426/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/545/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/953/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/459/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/469/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/655/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/668/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/439/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/473/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/453/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/460/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/470/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/419/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/448/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A

Changes its process name

Description Indicator Process Target
Changes the process name, possibly in an attempt to hide itself a /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/1023/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1063/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1154/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1359/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1488/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1014/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1151/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1100/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1091/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1124/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1169/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1256/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1344/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1087/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1118/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1137/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1222/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1242/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1492/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1073/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1253/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1289/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1189/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1481/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1489/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1191/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1164/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1141/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1067/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1111/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1133/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1155/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1196/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1343/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1049/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1186/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1193/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1479/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1482/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1166/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1177/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1270/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1290/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1332/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1376/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1080/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1298/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1149/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1172/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1486/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1146/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1070/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1129/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1160/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1182/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1187/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1306/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1322/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A
File opened for reading /proc/1043/maps /tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf N/A

Processes

/tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf

[/tmp/c2d6794eadc6c39e121cbd686a39a72d8020238a010647821348f3364513df93.elf]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 193.84.71.119:38241 tcp
US 151.101.1.91:443 tcp
GB 195.181.164.14:443 tcp
GB 185.125.188.62:443 tcp
GB 185.125.188.62:443 tcp

Files

N/A