Analysis
-
max time kernel
135s -
max time network
149s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
27-12-2024 14:14
Behavioral task
behavioral1
Sample
1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
4 signatures
150 seconds
General
-
Target
1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp
-
Size
77KB
-
MD5
ba87e19c8aa3fa63ff7c58881ea64af2
-
SHA1
155238e14e2996c2ce71eafb02f6f3cef449f40c
-
SHA256
bf5bcd45dc9723e5e834e1ada4f9048144913608cf88a9868c1c2b39f5faaa57
-
SHA512
61544931f63b9e5f6ba0bc991ed60f8d1be62f5a23b464ee1a64e622f7886507e0db1c42c983bcbe67ba685b339c560660dc16784d69ff832e1b76c2c63027d9
-
SSDEEP
1536:5sdR92glIQRSF2MhldlO+ttM98cKJdxZZxJ+BAQoEQ1It3R+yd5bUWarW8j0tZxw:md6dQRSQsdlX/3An2uc
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for modification /dev/misc/watchdog 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for modification /bin/watchdog 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp -
description ioc Process File opened for reading /proc/88/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/522/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/644/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/777/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1296/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1531/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/749/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/987/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1217/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/7/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/26/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/82/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1048/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1151/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1590/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/163/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/211/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/3/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/9/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/79/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/86/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/89/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/99/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/214/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/219/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/221/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/678/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1049/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/113/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/210/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/404/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/425/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1108/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1127/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/20/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/98/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/259/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1192/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/8/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/80/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/308/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/589/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/590/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1190/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/85/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/738/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1166/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1201/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1403/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1579/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/10/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/81/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/599/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/606/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1028/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1185/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/25/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/520/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/634/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/838/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1181/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1120/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp File opened for reading /proc/1163/status 1587-1-0x0000000000400000-0x0000000000614b00-memory.dmp