Malware Analysis Report

2024-12-07 17:27

Sample ID 241112-nn4mya1hqr
Target 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf
SHA256 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d
Tags
credential_access defense_evasion discovery mirai
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d

Threat Level: Known bad

The file 928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf was found to be: Known bad.

Malicious Activity Summary

credential_access defense_evasion discovery mirai

Mirai family

Modifies Watchdog functionality

Enumerates running processes

Reads process memory

Changes its process name

Reads runtime system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 11:33

Signatures

Mirai family

mirai

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 11:33

Reported

2024-11-12 11:36

Platform

ubuntu2204-amd64-20240611-en

Max time kernel

149s

Max time network

149s

Command Line

[/tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf]

Signatures

Modifies Watchdog functionality

defense_evasion
Description Indicator Process Target
File opened for modification /dev/watchdog /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for modification /dev/misc/watchdog /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A

Enumerates running processes

Reads process memory

credential_access
Description Indicator Process Target
File opened for reading /proc/589/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/669/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/780/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/990/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/424/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/525/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/583/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/585/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/590/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/600/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/631/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/635/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/406/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/410/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/962/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/737/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/781/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/645/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/871/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/446/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/523/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/603/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/633/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/679/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/741/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/757/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/843/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/404/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/591/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/836/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/629/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/632/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/756/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/770/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/841/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/866/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/971/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/693/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/748/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/499/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/500/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/956/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/983/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/409/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/425/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/766/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/775/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/991/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/412/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/607/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A

Changes its process name

Description Indicator Process Target
Changes the process name, possibly in an attempt to hide itself a /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/1317/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1192/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1160/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1254/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1286/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1014/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1181/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1345/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1176/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1085/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1165/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1408/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1431/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1134/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1145/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1479/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1552/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1605/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1098/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1302/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1469/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1164/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1182/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1119/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1193/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1294/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1563/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1598/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1185/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1277/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1409/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1202/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1089/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1105/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1143/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1177/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1320/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1419/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1063/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1127/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1158/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1323/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1046/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1114/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1184/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1398/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1075/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1326/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1550/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1035/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1052/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1056/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1157/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1162/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1169/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1197/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1213/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1040/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1601/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1299/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1225/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1600/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A
File opened for reading /proc/1090/maps /tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf N/A

Processes

/tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf

[/tmp/928cc6c6da15f3e8df4b213fdcdb3bf7891368b36a8e8dc3eb8e9bbb513c325d.elf]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 193.84.71.119:38241 tcp

Files

N/A