Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
10/12/2024, 02:36
Behavioral task
behavioral1
Sample
35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf
Resource
debian9-armhf-20240611-en
General
-
Target
35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf
-
Size
146KB
-
MD5
67c8b24fb45f61fcba82320e8b4e6d72
-
SHA1
4c7b007829f38257c8759e38e8cb4f559b23293c
-
SHA256
35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805
-
SHA512
316cff80b48d7236e9b0de226fd232ccfc13140b0c946db5be3f0f1ac5052506c622f9375c435ca40b691277a52f4be43d5835b74a2a371368177a45999bfd05
-
SSDEEP
3072:HxRizSAt/6Rv4dO21MiF13yO3U1CUeY0wMGNEyzap0kM/9xnr:HjizSO/6RQb13U1CU7hMqzapnM/9xnr
Malware Config
Signatures
-
Contacts a large (23467) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for modification /dev/misc/watchdog 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for modification /sbin/watchdog 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf -
Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/961/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/607/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/892/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/829/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/981/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/790/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/796/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/451/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/963/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/823/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/975/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/650/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/764/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/649/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/817/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/854/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/937/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/943/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/655/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/724/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/784/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/929/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/663/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/678/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/879/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/911/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/836/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/861/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/644/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/718/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/904/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/988/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/402/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/643/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/811/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/848/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/935/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/955/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/960/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/802/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/809/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/867/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/923/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/661/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/704/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/886/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/934/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/949/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/658/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/702/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/747/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/898/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/909/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/986/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/450/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/697/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/884/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/969/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/994/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/834/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/842/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/651/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/713/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/859/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 652 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf -
description ioc Process File opened for reading /proc/1232/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1021/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1047/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1064/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1089/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1107/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1087/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1195/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1214/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1072/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1226/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1257/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1212/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1023/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1057/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1095/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1170/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1207/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1270/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1139/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1164/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1189/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1201/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1000/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1132/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1245/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1120/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1011/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1039/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1048/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1062/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1073/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1114/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1151/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1030/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1264/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1098/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1145/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1157/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1239/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1187/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1237/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1034/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1082/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1112/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1162/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1126/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1137/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1176/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1220/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1262/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1006/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1013/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1182/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf File opened for reading /proc/1251/maps 35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf
Processes
-
/tmp/35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf/tmp/35d00496234b7f08ef4c7b3caebc7b0ec5384bea7642afda1e23fa396170a805.elf1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads process memory
- Changes its process name
- Reads runtime system information
PID:652