Malware Analysis Report

2024-12-07 16:35

Sample ID 241114-c74aqsspcy
Target 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf
SHA256 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823
Tags
defense_evasion discovery
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823

Threat Level: Shows suspicious behavior

The file 84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf was found to be: Shows suspicious behavior.

Malicious Activity Summary

defense_evasion discovery

Modifies Watchdog functionality

Enumerates running processes

Writes file to system bin folder

Reads runtime system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 02:43

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 02:43

Reported

2024-11-14 02:46

Platform

ubuntu2204-amd64-20240611-en

Max time kernel

148s

Max time network

152s

Command Line

[/tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf]

Signatures

Modifies Watchdog functionality

defense_evasion
Description Indicator Process Target
File opened for modification /dev/watchdog /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for modification /dev/misc/watchdog /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A

Enumerates running processes

Writes file to system bin folder

Description Indicator Process Target
File opened for modification /sbin/watchdog /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for modification /bin/watchdog /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/1560/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/83/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/86/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1404/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1477/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/373/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/499/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/673/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1396/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/78/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/745/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1114/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1122/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/2/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/3/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/7/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/25/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1534/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1301/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/217/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/644/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/693/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1050/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1425/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/11/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/18/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/23/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/590/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/98/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/109/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/210/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/307/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/9/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/13/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/22/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/26/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1208/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1267/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/308/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/411/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/425/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1153/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1289/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/21/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/213/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1129/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1138/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/95/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/584/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1041/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/446/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/778/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1167/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1315/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1180/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1596/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/8/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/80/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/113/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1102/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/212/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/980/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A
File opened for reading /proc/1158/status /tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf N/A

Processes

/tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf

[/tmp/84dac722161551d6735f84d82db956233322c1e2099000cc076c78ac177fa823.elf]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp
DE 45.137.70.156:3778 tcp

Files

N/A