Analysis
-
max time kernel
149s -
max time network
155s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
22-11-2024 18:06
Behavioral task
behavioral1
Sample
1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
-
Target
1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp
-
Size
61KB
-
MD5
ad7306ddd0e19db576bd7d96376ee8ca
-
SHA1
a6caf38ef1b732d8b1eb8e95fcae0e026cd609af
-
SHA256
18b17e0c30425b2e4ef1907588dce4eb244f75883c2b8f7a880c3a7718548641
-
SHA512
e436ec767c1c82fc940707bd4243c0475f1b705c26cbcd6af2836ea44cf1f2bd56a5d141747785fd8ce2c6ba05e54e9fe94229da5b4ea6e603b2fb057f8fc376
-
SSDEEP
1536:dxw3hN0SAV7yC76X61jB74l4PYo2hO5qsBFsOH2TOioz2zn:PwRN0jV7yC76X61SuPYo2hO7BFsOHIO8
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for modification /dev/misc/watchdog 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp -
description ioc Process File opened for reading /proc/682/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/616/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1990/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1075/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1103/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1127/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/428/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/533/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1527/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1099/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1517/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/2114/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/433/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1032/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1202/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/449/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/954/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1773/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1788/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1814/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1996/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/690/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/717/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/745/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1144/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1205/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/2150/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/976/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1821/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/262/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/588/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/954/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1083/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/505/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1539/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1550/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/2178/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/428/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/501/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1161/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/547/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1559/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1737/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1952/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/2080/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/437/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1514/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1569/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1585/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1964/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/447/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/736/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1157/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1187/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1904/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/2103/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/2172/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1521/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1027/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/447/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/504/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/2087/exe 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/453/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp File opened for reading /proc/1056/fd 1485-1-0x0000000008048000-0x0000000008058de0-memory.dmp