Analysis
-
max time kernel
149s -
max time network
8s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
01/12/2024, 12:05
Behavioral task
behavioral1
Sample
704-1-0x00008000-0x00026464-memory.dmp
Resource
debian9-armhf-20240611-en
debian-9-armhf
4 signatures
150 seconds
General
-
Target
704-1-0x00008000-0x00026464-memory.dmp
-
Size
76KB
-
MD5
53c1c805076a4fc415cf9e3fc7a13827
-
SHA1
8c4e44d9fcf0392a81eae9894d0257339b46be2e
-
SHA256
90f69311b0a1bdd45ff4b18fef57a2be926c7f3b626781d75b9e0e71f65cf554
-
SHA512
ee07f2cdd77f58a9bbfa2aeff8c194f92206277772a3a1603f502052794a8657dcc27f6f35177a63047878ccca25cdf936953043f1df7caa75f0875620ba2e9d
-
SSDEEP
1536:TJnF9sFw8gu6+wyKaw1KpIPrbvr/6Ra1styKtI8ll5BihwlTQP+8oG:RowpuQyNSG2eRa1styK9flTQPHo
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 704-1-0x00008000-0x00026464-memory.dmp File opened for modification /dev/misc/watchdog 704-1-0x00008000-0x00026464-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 704-1-0x00008000-0x00026464-memory.dmp File opened for modification /bin/watchdog 704-1-0x00008000-0x00026464-memory.dmp -
description ioc Process File opened for reading /proc/697/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/747/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/767/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/775/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/787/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/793/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/411/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/719/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/754/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/653/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/781/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/765/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/778/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/611/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/648/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/655/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/671/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/690/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/712/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/739/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/647/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/777/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/783/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/789/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/740/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/451/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/456/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/659/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/666/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/728/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/729/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/731/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/406/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/785/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/771/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/661/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/696/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/723/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/753/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/773/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/779/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/791/cmdline 704-1-0x00008000-0x00026464-memory.dmp File opened for reading /proc/654/cmdline 704-1-0x00008000-0x00026464-memory.dmp