b6a2de708f89bed3e51ea7cd7d7fa9b6b22bfd305c848a64acf0d7b5081ea76b

Analysis

max time kernel
149s
max time network
1s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27-12-2024 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

665-1-0x00008000-0x00026464-memory.dmp
Size

76KB
MD5

20fe94a8a628396e2f19794bee84dd03
SHA1

3a0b746b4f3c9a97ef92173d23ff2ba41df782a0
SHA256

b6a2de708f89bed3e51ea7cd7d7fa9b6b22bfd305c848a64acf0d7b5081ea76b
SHA512

16d58bd2ea98dee94e0129b289a0ba69987d85294fc5f642dfb89d062646db4737832aa07b7d18e53c3ca0ce5131904a28105bfe5d7b510a45c1f70907ee483a
SSDEEP

1536:TJnF9sFw8gu6+wyKaw1KpIPrbvr/6Ra1styKtI8ll5BihwlTQP+8oI:RowpuQyNSG2eRa1styK9flTQPHo

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	665-1-0x00008000-0x00026464-memory.dmp
File opened for modification	/dev/misc/watchdog	665-1-0x00008000-0x00026464-memory.dmp

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	665-1-0x00008000-0x00026464-memory.dmp
File opened for modification	/bin/watchdog	665-1-0x00008000-0x00026464-memory.dmp

Reads runtime system information 30 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/603/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/646/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/660/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/781/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/711/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/723/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/757/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/767/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/596/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/648/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/777/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/647/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/765/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/600/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/675/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/759/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/769/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/783/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/641/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/771/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/785/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/779/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/602/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/715/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/739/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/760/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/773/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/775/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/582/cmdline	665-1-0x00008000-0x00026464-memory.dmp
File opened for reading	/proc/652/cmdline	665-1-0x00008000-0x00026464-memory.dmp

/tmp/665-1-0x00008000-0x00026464-memory.dmp
/tmp/665-1-0x00008000-0x00026464-memory.dmp
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:649

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads