Analysis
-
max time kernel
149s -
max time network
147s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
12-11-2024 03:01
Behavioral task
behavioral1
Sample
d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf
Resource
debian9-armhf-20240729-en
General
-
Target
d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf
-
Size
58KB
-
MD5
15002dd354fe9805a35c818e599cd195
-
SHA1
87ecc7e747938a21b6d97a8bbbe0929ae1fe1ebd
-
SHA256
d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866
-
SHA512
68dfc26bab44c722982c39db51604bda04972f64a3ebac4ed29ec4da20c9ad265c2e7c62d26dd64cc67b115f4b9bc9d9cdf0743d36e74294510579596b3803f4
-
SSDEEP
768:ds+Vmz0XyboxDHdYGCyvMEcqXrgT8Rv7EolgG18HBTPOlRwoCK/1DLBNOoFYYauT:6+kICwDyGjrgclPYBjOlRrzFyM
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elfdescription ioc Process File opened for modification /dev/watchdog d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for modification /dev/misc/watchdog d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 31 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
Processes:
d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elfdescription ioc Process File opened for reading /proc/644/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/648/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/598/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/601/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/765/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/773/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/580/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/600/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/657/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/767/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/595/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/755/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/763/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/645/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/779/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/709/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/749/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/762/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/764/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/769/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/771/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/783/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/643/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/650/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/678/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/757/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/775/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/777/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/781/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/638/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf File opened for reading /proc/713/maps d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf -
Changes its process name 1 IoCs
Processes:
d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elfdescription ioc pid Process Changes the process name, possibly in an attempt to hide itself a 646 d683ac0fa9513e0a7f14ef083e3c49a7816f1cfd5ad61919dc37f7e45d57c866.elf