c8986532f06833c7746e9cdfba244deae70ff32a54ced320c7c7db6c8a59e8c4

Analysis

max time kernel
43s
max time network
153s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12-12-2024 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1567-1-0x0000000008048000-0x0000000008058f28-memory.dmp
Size

61KB
MD5

b9277588d906966b8eb8efdf44721fed
SHA1

141ee5ee5ff2a62f4651a8e58c8e388c07be61f9
SHA256

c8986532f06833c7746e9cdfba244deae70ff32a54ced320c7c7db6c8a59e8c4
SHA512

8f02bffcc4ef6819bee80dd380171a3e4b1cc4480a9864de9033df4dbe1b9afbd3ba2239f3c22b2cd6f52d044ffa026fa82ab2daa5bddd1f535f9e397e3dfc8a
SSDEEP

1536:vHB4xFZaeHW41ghY8FK3Y9/lA3DAOg9iV8VfDV0qOuucYv1P3lp9ibPK0k:vHB4xFZaeHW41ghY8FK3SW38OBSVfDeb

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (111802) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	1567-1-0x0000000008048000-0x0000000008058f28-memory.dmp
File opened for modification	/dev/misc/watchdog	1567-1-0x0000000008048000-0x0000000008058f28-memory.dmp

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1498	1567-1-0x0000000008048000-0x0000000008058f28-memory.dmp

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/	1567-1-0x0000000008048000-0x0000000008058f28-memory.dmp

/tmp/1567-1-0x0000000008048000-0x0000000008058f28-memory.dmp
/tmp/1567-1-0x0000000008048000-0x0000000008058f28-memory.dmp
1⤵
- Modifies Watchdog functionality
- Changes its process name
- Reads runtime system information
PID:1498

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads