52c827b69117d05537207028363c684590512d8a78ab223019bbea59df8de203

Analysis

max time kernel
150s
max time network
13s
platform
debian-12_mipsel
resource
debian12-mipsel-20240729-en
resource tags

arch:mipselimage:debian12-mipsel-20240729-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
19/01/2025, 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

710-1-0x00400000-0x00459af8-memory.dmp
Size

101KB
MD5

5c9d71cb01afbffbf21294d5ed80754e
SHA1

10352c99f9faf1a8537b708c0bfcefc1aa384592
SHA256

52c827b69117d05537207028363c684590512d8a78ab223019bbea59df8de203
SHA512

9dc863604a1a8eeea257a3ef6d4d9d652e5e48d2f98404dca27cb5d94f03545f00d109c898586bd6f1631f9595103a2dcd43e34cbaee7334ceb2d0506601ce44
SSDEEP

1536:gIn7oM+DituBuc9fLiTNZIaBpGLQZK7qPkR:hn7oM+DigAc9fMGLQoR

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	710-1-0x00400000-0x00459af8-memory.dmp
File opened for modification	/dev/misc/watchdog	710-1-0x00400000-0x00459af8-memory.dmp

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	710-1-0x00400000-0x00459af8-memory.dmp
File opened for modification	/bin/watchdog	710-1-0x00400000-0x00459af8-memory.dmp

Reads runtime system information 18 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/733/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/773/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/672/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/692/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/747/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/774/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/714/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/734/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/660/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/699/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/694/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/711/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/718/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/721/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/756/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/770/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/412/cmdline	710-1-0x00400000-0x00459af8-memory.dmp
File opened for reading	/proc/671/cmdline	710-1-0x00400000-0x00459af8-memory.dmp

/tmp/710-1-0x00400000-0x00459af8-memory.dmp
/tmp/710-1-0x00400000-0x00459af8-memory.dmp
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:743

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...