Analysis
-
max time kernel
136s -
max time network
146s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
27-12-2024 14:13
Behavioral task
behavioral1
Sample
1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
4 signatures
150 seconds
General
-
Target
1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp
-
Size
76KB
-
MD5
0862d4cae36f0d7d883b332f62241302
-
SHA1
a158d31f940265373c4f026307d794f19f316606
-
SHA256
8c7203c1f364eb9e64e90af45218eceb0f330aeaf395428e0b110c75769b3a01
-
SHA512
3b6ada2a3f49d091ec0f8de02f79a5c07cd02c503fca92c866140596a50629a03c124fd01364c1d6d10448f913a6103a9aa0fa5551f2d30bdb1ee8011c6fed51
-
SSDEEP
1536:FpmO4tlM904j3Kd60nGoQm+6JUt31gRr3VXgPgprm:PJ4g90O3KR16K96INm
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for modification /dev/misc/watchdog 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for modification /bin/watchdog 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp -
description ioc Process File opened for reading /proc/1107/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1159/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/5/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/6/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/8/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/101/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/707/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/967/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1277/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/10/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/506/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/839/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1037/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1103/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1158/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/95/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/528/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1162/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1234/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1539/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/9/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/91/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/163/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/728/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1010/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1139/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/92/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/119/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/409/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/674/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/23/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/93/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/768/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1053/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/589/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1210/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1184/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1198/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/200/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/263/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/593/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/741/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1096/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1157/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1242/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/75/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/778/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/794/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1337/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1562/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/79/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/90/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/210/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/315/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/634/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1561/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/78/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/225/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1061/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1074/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1123/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/1143/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/636/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp File opened for reading /proc/21/status 1610-1-0x0000000008048000-0x000000000805bc08-memory.dmp