Malware Analysis Report

2024-12-07 17:33

Sample ID 241112-dgxwpssmbw
Target d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf
SHA256 d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c
Tags
mirai credential_access defense_evasion discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c

Threat Level: Known bad

The file d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf was found to be: Known bad.

Malicious Activity Summary

mirai credential_access defense_evasion discovery

Mirai family

Modifies Watchdog functionality

Enumerates running processes

Reads process memory

Changes its process name

Reads runtime system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 02:59

Signatures

Mirai family

mirai

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 02:59

Reported

2024-11-12 03:01

Platform

ubuntu2404-amd64-20240523-en

Max time kernel

149s

Max time network

143s

Command Line

[/tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf]

Signatures

Modifies Watchdog functionality

defense_evasion
Description Indicator Process Target
File opened for modification /dev/watchdog /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for modification /dev/misc/watchdog /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A

Enumerates running processes

Reads process memory

credential_access
Description Indicator Process Target
File opened for reading /proc/588/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/791/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/419/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/433/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/510/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/584/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/828/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/442/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/511/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/776/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/825/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/786/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/794/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/833/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/732/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/736/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/761/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/780/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/458/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/580/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/792/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/897/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A

Changes its process name

Description Indicator Process Target
Changes the process name, possibly in an attempt to hide itself a /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/1866/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1893/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1958/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2090/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1764/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1337/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1654/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2255/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1052/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1124/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1736/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1843/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2450/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2471/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2475/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1046/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2095/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2447/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1069/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1915/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1957/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1959/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2228/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2234/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1902/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1744/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1756/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1870/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1129/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1903/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1933/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1951/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2048/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2191/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2246/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1078/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1644/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1652/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1845/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1899/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1940/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2085/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2101/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1254/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2259/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2439/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2204/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1888/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1920/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1948/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1058/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1086/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1767/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1930/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2157/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2177/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1061/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1797/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1945/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/2445/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1092/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1396/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1397/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A
File opened for reading /proc/1649/maps /tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf N/A

Processes

/tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf

[/tmp/d1e8a6530cfab107e6d58717d9052d0570b60b65ec670dc82470b1a9e3dcb89c.elf]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 193.84.71.119:38241 tcp

Files

N/A