c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f

Analysis

max time kernel
150s
max time network
147s
platform
debian-12_mipsel
resource
debian12-mipsel-20240729-en
resource tags

arch:mipselimage:debian12-mipsel-20240729-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
03/02/2025, 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
Size

86KB
MD5

a6b62a5dfc8c6d736dfb75920fa16697
SHA1

d8ffa31d8a26943aa46f9f31a43eac84e171ffb0
SHA256

c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
SHA512

65e23e663c19ce43ecd87c4d78bcecedc0bf72aef95f7a4296c2c0dcc1f820b237c9c55065be2dc894302e6752b17274aa89ff37e88a5745cc93531d153cd292
SSDEEP

1536:VwjrooP6LS1c/s9knEDoF3k5azHnZWyFpC:WjrooPyS1cm4Hn

Score

7^/10

credential_access defense_evasion

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for modification	/dev/misc/watchdog	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f

Reads process memory 1 TTPs 18 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/406/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/431/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/682/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/697/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/747/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/681/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/712/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/719/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/723/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/751/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/408/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/669/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/699/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/732/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/713/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/733/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/745/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
File opened for reading	/proc/775/maps	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	742	c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f

/tmp/c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
/tmp/c2208a7e40e80f4b94ae9700432f2ff7de5aeb6c5a98b01fe2437e2fb573601f
1⤵
- Modifies Watchdog functionality
- Reads process memory
- Changes its process name
PID:742

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...