Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
147s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240611-en -
resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
11/03/2025, 02:58
Behavioral task
behavioral1
Sample
43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf
Resource
debian9-mipsel-20240611-en
General
-
Target
43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf
-
Size
51KB
-
MD5
d73c770338042b8f503e54fd32541aad
-
SHA1
cdcd238715b649ad335b085141ce3b9943c6c4d9
-
SHA256
43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440
-
SHA512
b4785d734e3d354b0c4eb507c03a0fcfe88eed0741d4b0595bae599edb3ddeb09f6579a22d17cac6cb1187a35c10eff769c069fc586a39ae3572773a4986899e
-
SSDEEP
768:Q8mN65nxTY4WpetK3hLw2SM5tyeFEeWDeSamIj6oCXio4qNtq:Q8mN65n2j9wnMOQEvDzamIOo4N
Malware Config
Signatures
-
Contacts a large (14599) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for modification /dev/watchdog 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf -
Renames itself 1 IoCs
pid Process 709 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 168.235.111.72 Destination IP 81.169.136.222 -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 49 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/744/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/755/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/771/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/775/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/776/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/788/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/790/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/792/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/751/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/761/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/779/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/784/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/804/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/806/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/808/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/745/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/757/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/765/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/772/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/799/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/800/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/813/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/747/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/753/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/780/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/739/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/749/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/798/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/812/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/743/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/759/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/796/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/805/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/810/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/748/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/762/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/767/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/769/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/786/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/787/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/794/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/741/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/742/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/756/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/763/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/768/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/774/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/777/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/802/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself systemd-journal 709 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf -
description ioc Process File opened for reading /proc/745/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/772/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/794/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/800/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/331/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/673/status 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/699/status 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/787/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/16/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/143/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/327/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/384/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/753/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/749/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/755/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/10/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/236/status 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/769/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/15/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/19/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/76/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/805/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/700/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/761/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/331/status 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/756/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/808/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/11/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/18/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/105/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/113/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/784/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/780/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/335/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/677/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/678/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/3/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/23/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/81/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/236/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/425/status 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/71/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/678/status 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/327/status 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/713/status 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/798/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/812/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/73/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/340/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/9/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/684/status 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/self/maps 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/36/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/72/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/74/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/670/status 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/742/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/743/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/776/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/777/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/765/cmdline 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/21/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/78/comm 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf File opened for reading /proc/143/status 43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf
Processes
-
/tmp/43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf/tmp/43e9eb915b547d4ff40678020a90e406176697f0a0f06982adf572896f8bb440.elf1⤵
- Modifies Watchdog functionality
- Renames itself
- Enumerates active TCP sockets
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:709