Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
158s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
11/01/2025, 09:49
Behavioral task
behavioral1
Sample
648-1-0x00008000-0x00027bc8-memory.dmp
Resource
debian9-armhf-20240611-en
debian-9-armhf
4 signatures
150 seconds
General
-
Target
648-1-0x00008000-0x00027bc8-memory.dmp
-
Size
84KB
-
MD5
e0611fcd1fcd391c253b5e34d38acbf8
-
SHA1
786111cddf3bb516f6ad4122718167b1a80ca37d
-
SHA256
86afd4199162d5548ecae85b49711d9ee03d62882483ac1cb2693821d904c69a
-
SHA512
95028969bd03cd5f2f66b5f8542e56297ab08dc37168fee7989b29b05ad59ab8b41cf5aa7407cf115bc3b72e0f7c10448ada4586f1fbdebc8e076b1e56c92e43
-
SSDEEP
1536:sXKXihcQrrmdLaFmzrJwwHKvfJaZJoyYF9Cz+RQnkQjBQ5Gdv2N5:QKXQPSQWr+wHKvRce/F9Cz+6nkQjBQ2m
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 648-1-0x00008000-0x00027bc8-memory.dmp File opened for modification /dev/misc/watchdog 648-1-0x00008000-0x00027bc8-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 648-1-0x00008000-0x00027bc8-memory.dmp File opened for modification /bin/watchdog 648-1-0x00008000-0x00027bc8-memory.dmp -
description ioc Process File opened for reading /proc/1/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/15/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/17/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/19/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/602/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/22/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/2/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/26/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/265/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/284/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/107/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/269/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/641/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/642/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/649/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/9/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/24/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/28/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/297/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/310/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/18/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/109/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/167/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/322/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/5/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/268/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/601/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/648/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/23/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/98/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/139/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/141/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/4/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/8/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/42/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/76/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/646/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/6/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/16/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/647/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/27/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/140/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/594/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/3/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/7/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/10/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/13/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/14/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/11/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/25/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/29/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/186/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/301/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/264/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/644/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/652/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/20/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/43/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/110/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/213/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/262/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/635/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/598/status 648-1-0x00008000-0x00027bc8-memory.dmp File opened for reading /proc/12/status 648-1-0x00008000-0x00027bc8-memory.dmp