Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
02/02/2025, 04:35
Behavioral task
behavioral1
Sample
84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf
Resource
debian9-armhf-20240611-en
General
-
Target
84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf
-
Size
77KB
-
MD5
45a33a3f566fe9a6ee1e492d1905634d
-
SHA1
2839588f169759f13e9377f05128d862e7c00f6f
-
SHA256
84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756
-
SHA512
501a80cf158c3d87cfa1e86c0730dc09f31e206f84ea9d7d1468b2fc08e9366c7e6d1609d6035d64c08842fb480403dd445d68de6e36061625d6780e17d83505
-
SSDEEP
1536:Zxn7gLqXIQHj0jLwdeEyQqF1G4/BSc9Zg9ZUzMVy9r2UQZdljuit+AG2:kLgIZjLqeECl/BSyIWzMVy9r2Nd+AB
Malware Config
Signatures
-
Contacts a large (109443) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
pid Process 648 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for modification /dev/misc/watchdog 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf -
Renames itself 1 IoCs
pid Process 648 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf -
Unexpected DNS network traffic destination 21 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 51.158.108.203 Destination IP 51.158.108.203 Destination IP 152.53.15.127 Destination IP 51.158.108.203 Destination IP 152.53.15.127 Destination IP 51.158.108.203 Destination IP 51.158.108.203 Destination IP 51.158.108.203 Destination IP 152.53.15.127 Destination IP 152.53.15.127 Destination IP 152.53.15.127 Destination IP 152.53.15.127 Destination IP 152.53.15.127 Destination IP 152.53.15.127 Destination IP 51.158.108.203 Destination IP 51.158.108.203 Destination IP 51.158.108.203 Destination IP 152.53.15.127 Destination IP 152.53.15.127 Destination IP 152.53.15.127 Destination IP 51.158.108.203 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/718/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/748/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/776/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/783/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/699/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/712/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/771/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/785/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/681/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/693/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/719/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/756/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/685/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/698/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/711/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/722/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/724/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/738/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/682/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/703/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/744/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/777/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/781/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/688/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/740/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/745/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/752/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/765/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/708/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/715/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/772/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/728/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/736/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/746/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/758/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/769/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/689/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/707/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/739/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/757/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/767/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/773/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/683/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/684/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/695/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/742/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/694/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/704/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/779/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/775/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/691/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/701/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/721/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/731/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/732/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/751/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/754/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/697/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/730/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/687/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/710/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/735/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/760/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/770/maps 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf -
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 648 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf -
description ioc Process File opened for reading /proc/724/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/754/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/781/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/750/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/767/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/145/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/710/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/721/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/785/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/594/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/703/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/748/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/736/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/769/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/262/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/263/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/719/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/641/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/704/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/783/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/707/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/731/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/758/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/779/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/643/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/691/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/701/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/166/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/600/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/718/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/746/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/277/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/278/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/634/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/685/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/694/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/695/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/708/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/715/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/274/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/332/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/681/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/757/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/773/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/730/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/735/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/740/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/688/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/693/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/699/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/705/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/307/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/640/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/687/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/689/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/732/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/738/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/756/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/760/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/295/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/587/status 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/683/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/770/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf File opened for reading /proc/682/cmdline 84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf
Processes
-
/tmp/84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf/tmp/84450bcfa08e7c33b1ea94302457a478b394ef0996f626ee5f1c60ab83024756.elf1⤵
- Deletes itself
- Modifies Watchdog functionality
- Renames itself
- Enumerates active TCP sockets
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:648