Malware Analysis Report

2024-12-07 19:17

Sample ID 241114-ddmxbstdrj
Target a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf
SHA256 a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250
Tags
mirai credential_access defense_evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250

Threat Level: Known bad

The file a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf was found to be: Known bad.

Malicious Activity Summary

mirai credential_access defense_evasion

Mirai family

Modifies Watchdog functionality

Enumerates running processes

Reads process memory

Changes its process name

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 02:53

Signatures

Mirai family

mirai

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 02:53

Reported

2024-11-14 02:56

Platform

debian9-armhf-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

[/tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf]

Signatures

Modifies Watchdog functionality

defense_evasion
Description Indicator Process Target
File opened for modification /dev/watchdog /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for modification /dev/misc/watchdog /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A

Enumerates running processes

Reads process memory

credential_access
Description Indicator Process Target
File opened for reading /proc/669/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/675/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/676/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/781/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/785/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/787/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/426/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/662/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/704/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/705/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/789/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/795/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/802/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/661/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/801/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/797/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/656/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/413/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/799/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/783/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/791/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/667/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/655/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/660/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/665/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/749/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/793/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/464/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/618/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/778/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/780/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A
File opened for reading /proc/463/maps /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A

Changes its process name

Description Indicator Process Target
Changes the process name, possibly in an attempt to hide itself a /tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf N/A

Processes

/tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf

[/tmp/a51984808c733ab96f33c55556c6d58ff7673484ee0397d0e12991d3193bc250.elf]

Network

Country Destination Domain Proto
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 193.84.71.119:38241 tcp

Files

N/A