Analysis
-
max time kernel
148s -
max time network
151s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240729-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
26-12-2024 21:19
Behavioral task
behavioral1
Sample
1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp
Resource
ubuntu2004-amd64-20240729-en
ubuntu-20.04-amd64
4 signatures
150 seconds
General
-
Target
1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp
-
Size
73KB
-
MD5
6d7c18051d4e7a5bb6989254bf808301
-
SHA1
b672271d5c612d1def6d1904d36292a877ebd9ba
-
SHA256
8faf117f8e58e78df41bf70a5857b1ac3b09b4246332e2a0b83b1613bd68cb50
-
SHA512
fe8c03b934703773054181eac02001d368962314f5c20180f0a119f6384e12593823276c0cf613f67a1d455fa152c8b5fa0e3f7571a8b5d218e7369b612bcb27
-
SSDEEP
768:vgbgWgQ5bd+2RcZmT9lX8RTt7sVzJuPucHNVzibDj+C5bz4Hn7UKAv+kblUZ3ak/:WeuIZobvuGctIb/+w4HnC+8l8AnzcfH/
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for modification /dev/misc/watchdog 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for modification /bin/watchdog 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp -
description ioc Process File opened for reading /proc/77/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/169/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/175/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/758/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/949/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/977/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/200/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/439/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/583/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/637/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/686/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/992/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1019/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1024/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1050/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/75/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/161/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/300/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/445/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/899/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1070/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1347/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1349/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1399/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/3/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/170/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/440/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/669/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/790/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/824/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1336/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1344/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/86/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/163/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/543/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1087/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1090/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1113/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/9/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/84/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/160/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/481/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/482/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1340/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1359/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/11/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/81/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/91/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/177/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/672/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1342/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/4/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/5/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/13/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/72/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/87/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/102/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/168/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/635/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/805/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1100/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/1341/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/16/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp File opened for reading /proc/453/status 1575-1-0x0000000000400000-0x00000000005156e8-memory.dmp