Analysis
-
max time kernel
149s -
max time network
8s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
08/12/2024, 18:24
Behavioral task
behavioral1
Sample
712-1-0x00008000-0x00026460-memory.dmp
Resource
debian9-armhf-20240611-en
debian-9-armhf
4 signatures
150 seconds
General
-
Target
712-1-0x00008000-0x00026460-memory.dmp
-
Size
76KB
-
MD5
2d8c994f6d0bbd04e6dc224af939eb1e
-
SHA1
2457033d5d34abbcf501c5a2bda86cb101338de7
-
SHA256
a9c697f18311f3b952f4ddd10ef98a13ab2c03a40c7c4547de3b51ab99109779
-
SHA512
3b8be6817018d89238013b8cd6e2380b39c01a25c721390d2ef54630918a7dab467279ddaf9eac87b4ddc28afff684230a4140503da2023bb64adb24dfa11438
-
SSDEEP
1536:O0n09sBw8wu66UyKe8RK1IPL7vrQ/yRSxscBqlIull42piLGIvdWKE0:K8wxuQyBKaeWyRSxscBqPmGIvdWD0
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 712-1-0x00008000-0x00026460-memory.dmp File opened for modification /dev/misc/watchdog 712-1-0x00008000-0x00026460-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 712-1-0x00008000-0x00026460-memory.dmp File opened for modification /bin/watchdog 712-1-0x00008000-0x00026460-memory.dmp -
description ioc Process File opened for reading /proc/678/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/684/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/714/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/792/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/667/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/737/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/741/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/800/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/805/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/807/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/489/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/672/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/673/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/783/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/720/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/734/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/785/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/429/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/488/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/666/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/701/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/753/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/761/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/790/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/809/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/441/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/629/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/796/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/798/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/674/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/749/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/775/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/776/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/794/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/811/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/680/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/708/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/802/cmdline 712-1-0x00008000-0x00026460-memory.dmp File opened for reading /proc/804/cmdline 712-1-0x00008000-0x00026460-memory.dmp