Analysis
- max time kernel
1s - max time network
131s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
05/09/2026, 09:10
Static task
static1
Behavioral task
behavioral1
Sample
36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989
- Size 205KB
- Sample260905-k48p2sysaw
- SHA256 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989
- MD5 485bc6c05be1e8c1ecaa9021cdd87597
- SHA1 d8f3c039e6e0c748a2b0576411fdb626f5302920
- SHA512 5d047dc994f3ca02736003de17346dc0f387f7ab8d83c574b2377c57f73e0be401c12b38c85b11c9d7333b3363b185f41fcc980eaf5244e82dae76e567de9e84
- SSDEEP 6144:dxIToUbZDsSj+U4DnKayMU4QeMsbYH8cTNkqejKa:eZDsSj+U1a44QHsbYH8cRkx
- TLSH T15F243A0EF902D8F1F07291F1068ED3E17D30A4F75237AD62EF6B2AB1BA272915D05259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/32/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/84/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/98/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/160/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/174/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/23/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/81/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/158/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/12/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/137/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/166/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/169/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/11/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/18/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/27/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/34/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/167/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/6/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/171/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/163/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/5/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/8/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/13/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/21/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/24/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/29/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/35/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/9/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/20/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/25/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/28/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/78/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/89/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/115/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/3/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/162/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/170/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/172/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/17/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/19/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/30/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/82/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/10/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/14/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/86/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/31/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/80/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/83/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/165/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/201/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/36/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/202/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/7/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/22/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/79/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/168/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/173/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/157/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/159/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/4/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/176/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/16/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/161/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/164/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 - Enumerates kernel/hardware configuration 1 TTPs 17 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/cpu,cpuacct/cgroup.procs 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/cpu,cpuacct/user.slice/user-0.slice/session-1.scope/cgroup.procs 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/cpu,cpuacct/system.slice 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/hugetlb 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/cpu,cpuacct 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/cpu,cpuacct/user.slice/cgroup.procs 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/cpu,cpuacct/user.slice/user-0.slice/cgroup.procs 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/cpu,cpuacct/user.slice/user-0.slice/[email protected]/cgroup.procs 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/cpu,cpuacct/system.slice/cgroup.procs 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/rdma/cgroup.procs 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/cpu,cpuacct/user.slice/user-0.slice/[email protected] 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/hugetlb/cgroup.procs 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/rdma 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/cpu,cpuacct/user.slice 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/cpu,cpuacct/user.slice/user-0.slice 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /sys/fs/cgroup/cpu,cpuacct/user.slice/user-0.slice/session-1.scope 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 -
description ioc Process File opened for reading /proc/1068/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1528/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/334/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/31/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/32/cmdline 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/259/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/989/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1089/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1255/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1320/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/16/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/29/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/431/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1037/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1042/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1068/cmdline 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/23/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1047/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/115/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/173/cmdline 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/498/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1069/cmdline 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1090/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/5/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/906/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/942/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1054/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1130/cmdline 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1485/maps 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/659/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/909/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1515/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/165/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/430/cmdline 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1090/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/531/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1088/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/170/cmdline 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/430/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1013/cmdline 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/436/cmdline 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/715/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/31/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1069/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1255/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1513/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/26/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/452/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/463/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1046/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/89/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/465/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1066/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1517/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/8/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/970/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/14/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/80/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1014/status 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/176/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/201/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/1054/comm 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/79/mounts 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989 File opened for reading /proc/28/cmdline 36dba719af2a40b30a8e89ef4b967dbfa1b945007b47afa8a62d5ce4d0409989
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/TITAN.CLaimed
- Size 20B
- SHA256 c51d7d555ca6d254bf53f7dbedfc13a0ab825b4f49a12adac31136f51736d53c
- MD5 a90eee7b6a5382b7163f5a4aeccfb8a1
- SHA1 fdfb35137b815beab2ce55824cb228fef36e6bf5
- SHA512 afdcbf51719c7df47b6ca85a413a1ec462c2d10ab3587f074b7460ec7e13ca0b5e9a4699c89561649b1a30715048831a087e504c30dca24b9eecfdc24f95c6e2
- MD5 SHA1 SHA512