Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
166s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
11/03/2025, 05:49
Behavioral task
behavioral1
Sample
fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf
Resource
debian12-armhf-20240221-en
General
-
Target
fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf
-
Size
82KB
-
MD5
a9675614a267473cb83e195d9074a067
-
SHA1
a4d148cf841fc2b84c8bb3dd322e40f601532875
-
SHA256
fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9
-
SHA512
8adcc5df013328218823d3310bcc4f27f6e1e9e51de2e7ecd5521873f5ac6cc2315f9136e1599f1da4114e65eaed23449e78f9ce04062243aa8ec793086b1c28
-
SSDEEP
1536:BRn0RQX3XBK48wT+4D3H2qFzu6gRGrkesfzx3n7etZNlncUGqDllWYi/XRAsmzXT:XXnBA4D3HLFzut/euzN7etZNlncUSpXk
Malware Config
Signatures
-
Contacts a large (82166) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for modification /dev/watchdog fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf -
Renames itself 1 IoCs
pid Process 711 fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 168.235.111.72 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 23 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/742/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/755/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/760/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/763/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/765/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/767/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/739/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/746/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/750/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/753/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/759/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/743/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/754/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/756/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/757/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/762/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/764/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/737/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/745/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/751/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/766/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/740/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/741/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself kapmd 711 fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf -
description ioc Process File opened for reading /proc/312/status fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/28/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/329/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/691/status fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/756/cmdline fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/8/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/16/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/46/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/199/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/750/cmdline fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/688/status fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/32/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/74/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/575/status fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/753/cmdline fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/3/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/252/status fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/358/status fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/668/status fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/762/cmdline fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/33/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/312/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/342/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/739/cmdline fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/34/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/38/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/45/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/344/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/710/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/687/status fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/713/status fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/740/cmdline fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/741/cmdline fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/29/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/319/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/17/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/22/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/26/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/58/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/321/status fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/763/cmdline fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/143/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/219/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/570/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/713/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/217/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/self/maps fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/751/cmdline fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/326/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/575/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/745/cmdline fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/755/cmdline fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/35/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/709/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/329/status fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/444/status fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/445/status fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/764/cmdline fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/14/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/321/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/746/cmdline fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/7/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/47/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf File opened for reading /proc/52/comm fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf
Processes
-
/tmp/fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf/tmp/fe4e8d464b7849a5483782d0c47e53deaf199e284badad12ed98ca79e47a79d9.elf1⤵
- Modifies Watchdog functionality
- Renames itself
- Enumerates active TCP sockets
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:711