Analysis
-
max time kernel
146s -
max time network
148s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
26-12-2024 21:25
Behavioral task
behavioral1
Sample
710-1-0x00400000-0x0045af60-memory.dmp
Resource
debian9-mipsbe-20240611-en
debian-9-mips
4 signatures
150 seconds
General
-
Target
710-1-0x00400000-0x0045af60-memory.dmp
-
Size
98KB
-
MD5
13a69e54cc97cb86aa1c45064a49010a
-
SHA1
bdbeb3c7f912d2347b49cf38ae9c4ca0de966a66
-
SHA256
fcaeea08e393082faa77a36274805ed7319196f0f615436f925cc822db8674a8
-
SHA512
3f16ffe52665551e6a69f7b32e375936267cbc1a51c4dfca29e96d591aab24635985546b46deb21f55c0906b3f0e764b9f7f2ad3b5a9e3b5968cc1ef0200ab9d
-
SSDEEP
1536:HpaZOuT/Q30SQXa1r3J62yqPy/RWLW0edmpwjeNNYC:0ZzTJa1rZ62yqPy/ULWzjeNNl
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 710-1-0x00400000-0x0045af60-memory.dmp File opened for modification /dev/misc/watchdog 710-1-0x00400000-0x0045af60-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 710-1-0x00400000-0x0045af60-memory.dmp File opened for modification /bin/watchdog 710-1-0x00400000-0x0045af60-memory.dmp -
description ioc Process File opened for reading /proc/700/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/2/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/17/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/22/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/75/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/330/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/685/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/18/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/150/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/695/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/7/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/8/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/9/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/70/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/375/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/701/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/11/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/16/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/4/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/6/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/359/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/361/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/702/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/81/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/681/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/3/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/13/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/71/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/76/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/82/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/331/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/14/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/19/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/77/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/119/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/36/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/73/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/376/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/412/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/669/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/696/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/1/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/15/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/20/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/37/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/78/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/5/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/74/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/381/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/680/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/707/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/10/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/146/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/326/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/665/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/23/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/24/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/72/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/109/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/118/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/227/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/328/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/698/status 710-1-0x00400000-0x0045af60-memory.dmp File opened for reading /proc/703/status 710-1-0x00400000-0x0045af60-memory.dmp