Analysis
-
max time kernel
148s -
max time network
153s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
27-12-2024 01:34
Behavioral task
behavioral1
Sample
1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
4 signatures
150 seconds
General
-
Target
1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp
-
Size
76KB
-
MD5
47c23a9752d8c184f0c32b5501434566
-
SHA1
087037943fc79a57b8e8fa83768c0963566a421c
-
SHA256
f1347230af8172479a8ea1bbb7dafb0ec06c2cee626652dcf99f279b407d69dd
-
SHA512
407c9397495e9881367cc8cda3a599d7d9c6e5ae20ac7379b75e1b4a8728ce05e79660a0ec5c0633c0c8fe5e4a371414fd0fb7c4b82fdb0014dee91415d82255
-
SSDEEP
1536:/xTlM904jZVzd6kzGoYGiapUN31gRr313kPQxrm:/xm90OZVz9Z6K9GIlm
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for modification /dev/misc/watchdog 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for modification /bin/watchdog 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp -
description ioc Process File opened for reading /proc/373/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/953/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/988/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/2/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/8/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/215/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/310/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/762/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1030/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/3/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/19/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/23/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1138/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/80/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/96/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/212/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/644/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1191/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1317/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1129/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1197/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/22/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/82/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/93/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/582/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/632/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/980/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1578/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/73/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/499/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/838/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1114/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1182/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1268/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1328/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/25/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/209/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/425/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/599/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1073/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1156/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1425/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/75/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/631/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/663/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/987/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1169/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/91/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/446/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1203/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1577/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/5/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/79/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/220/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/225/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/259/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1077/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/16/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/92/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/97/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/764/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/94/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1093/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1324/status 1392-1-0x0000000008048000-0x000000000805bc08-memory.dmp