f63d02938229723c8a0b92de1b21e423a2ead1dc3f6abd354db2d6ffae7ed906

description	ioc	Process
File opened for modification	/etc/gshadow	groupadd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/group	groupadd

OS Credential Dumping 1 TTPs 1 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd

Adds a user to the system 1 IoCs

pid	Process
2195	useradd

Changes its process name 4 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	gmain	2170	hexlicsrv94_x64linux.run
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2171	hexlicsrv94_x64linux.run
Changes the process name, possibly in an attempt to hide itself	pool-Setup	2177	hexlicsrv94_x64linux.run
Changes the process name, possibly in an attempt to hide itself	gdbus	2178	hexlicsrv94_x64linux.run

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	hexlicsrv94_x64linux.run

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	hexlicsrv94_x64linux.run

Command and Scripting Interpreter: Unix Shell 1 TTPs 7 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
2183	sh
2185	sh
2192	sh
2194	sh
2202	sh
2205	sh
2340	sh

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/module/apparmor/parameters/enabled	dbus-daemon
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon

Reads runtime system information 25 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/self/fd	dbus-daemon
File opened for reading	/proc/2036/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	hexlicsrv94_x64linux.run
File opened for reading	/proc/self/fd	dbus-launch
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/2176/status	dbus-daemon
File opened for reading	/proc/sys/kernel/random/boot_id	id
File opened for reading	/proc/sys/kernel/cap_last_cap	groupadd
File opened for reading	/proc/sys/kernel/random/boot_id	groupadd
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/meminfo	hexlicsrv94_x64linux.run
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/sys/kernel/random/boot_id	id
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/sys/kernel/random/boot_id	useradd
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/2176/attr/apparmor/current	dbus-daemon
File opened for reading	/proc/filesystems	groupadd
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/sys/kernel/cap_last_cap	useradd
File opened for reading	/proc/filesystems	systemctl

System Information Discovery 1 TTPs 48 IoCs

Adversaries may gather information about the system, such as OS, hostname, and hardware details.

System Information Discovery

pid	Process
2108	lsb_release
2123	lsb_release
2123	lsb_release
2042	lsb_release
2057	lsb_release
2123	lsb_release
2124	getopt
2138	lsb_release
2138	lsb_release
2139	getopt
2043	getopt
2057	lsb_release
2072	lsb_release
2108	lsb_release
2108	lsb_release
2138	lsb_release
2042	lsb_release
2108	lsb_release
2108	lsb_release
2109	getopt
2123	lsb_release
2138	lsb_release
2042	lsb_release
2042	lsb_release
2042	lsb_release
2057	lsb_release
2072	lsb_release
2123	lsb_release
2057	lsb_release
2072	lsb_release
2108	lsb_release
2123	lsb_release
2138	lsb_release
2057	lsb_release
2138	lsb_release
2042	lsb_release
2057	lsb_release
2057	lsb_release
2072	lsb_release
2072	lsb_release
2072	lsb_release
2123	lsb_release
2138	lsb_release
2042	lsb_release
2058	getopt
2072	lsb_release
2073	getopt
2108	lsb_release

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
2073	getopt
2109	getopt
2124	getopt
2139	getopt
2043	getopt
2058	getopt

Writes file to tmp directory 44 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/open_project-16px_disabled.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brBPKWCU	hexlicsrv94_x64linux.run
File opened for modification	/tmp/br2gOWgb	hexlicsrv94_x64linux.run
File opened for modification	/tmp/br439db1	hexlicsrv94_x64linux.run
File opened for modification	/tmp/br15677d	hexlicsrv94_x64linux.run
File opened for modification	/tmp/br0vGe3Z	hexlicsrv94_x64linux.run
File opened for modification	/tmp/br7f3284	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/file-16px.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/wmImage.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/br4bc999	hexlicsrv94_x64linux.run
File opened for modification	/tmp/br3yhcEl	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brwBV5is	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brQbIZdL	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brEsdyvD	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/logoImage.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/open_directory-16px_selected.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/updir.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/x01image_small.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/br921097	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/open_directory-16px_disabled.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brvQ6rYI	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brhfnAtj	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brhT57dy	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brWZDClB	hexlicsrv94_x64linux.run
File opened for modification	/tmp/br25fd3f	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/msgbox-warning.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/open_project-16px_selected.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brkcM91r	hexlicsrv94_x64linux.run
File opened for modification	/tmp/br3d6483	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brqLouMK	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brp7I4uE	hexlicsrv94_x64linux.run
File opened for modification	/tmp/bri8bwsn	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/msgbox-error.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/msgbox-info.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/splashImage.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brcd7e84	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/leftImage.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/msgbox-question.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/open_project-16px.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/installbuilder_installer.log	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brynGQFS	hexlicsrv94_x64linux.run
File opened for modification	/tmp/brQJNk2g	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/folder-16px.png	hexlicsrv94_x64linux.run
File opened for modification	/tmp/.installbuilder/.tmp_2036_5618668/open_directory-16px.png	hexlicsrv94_x64linux.run

/tmp/hexlicsrv94_x64linux.run
/tmp/hexlicsrv94_x64linux.run
1⤵
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Reads runtime system information
- Writes file to tmp directory
PID:2036
- /usr/local/sbin/id
  id -u
  2⤵
  PID:2038
- /usr/local/bin/id
  id -u
  2⤵
  PID:2038
- /usr/sbin/id
  id -u
  2⤵
  PID:2038
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:2038
- /sbin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2042
- /usr/sbin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2042
- /usr/local/sbin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2042
- /usr/local/sbin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2042
- /usr/local/bin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2042
- /usr/sbin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2042
- /usr/bin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2042
- - /usr/bin/getopt
    getopt --name lsb_release -o hvidrcas -l "help,version,id,description,release,codename,all,short" -- -i
    3⤵
    - System Information Discovery
    - System Network Configuration Discovery
    PID:2043
- - /usr/bin/tr
    tr "[:lower:]" "[:upper:]"
    3⤵
    PID:2047
- - /usr/bin/cut
    cut -c1
    3⤵
    PID:2046
- - /usr/bin/cut
    cut -c2-
    3⤵
    PID:2050
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2053
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2056
- /sbin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2057
- /usr/sbin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2057
- /usr/local/sbin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2057
- /usr/local/sbin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2057
- /usr/local/bin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2057
- /usr/sbin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2057
- /usr/bin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2057
- - /usr/bin/getopt
    getopt --name lsb_release -o hvidrcas -l "help,version,id,description,release,codename,all,short" -- -r
    3⤵
    - System Information Discovery
    - System Network Configuration Discovery
    PID:2058
- - /usr/bin/cut
    cut -c1
    3⤵
    PID:2061
- - /usr/bin/tr
    tr "[:lower:]" "[:upper:]"
    3⤵
    PID:2062
- - /usr/bin/cut
    cut -c2-
    3⤵
    PID:2065
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2068
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2071
- /sbin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2072
- /usr/sbin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2072
- /usr/local/sbin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2072
- /usr/local/sbin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2072
- /usr/local/bin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2072
- /usr/sbin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2072
- /usr/bin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2072
- - /usr/bin/getopt
    getopt --name lsb_release -o hvidrcas -l "help,version,id,description,release,codename,all,short" -- -c
    3⤵
    - System Information Discovery
    - System Network Configuration Discovery
    PID:2073
- - /usr/bin/cut
    cut -c1
    3⤵
    PID:2076
- - /usr/bin/tr
    tr "[:lower:]" "[:upper:]"
    3⤵
    PID:2077
- - /usr/bin/cut
    cut -c2-
    3⤵
    PID:2082
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2086
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2091
- /sbin/lsb_release
  lsb_release -d
  2⤵
  PID:2093
- /usr/sbin/lsb_release
  lsb_release -d
  2⤵
  PID:2093
- /usr/local/sbin/lsb_release
  lsb_release -d
  2⤵
  PID:2093
- /usr/local/sbin/lsb_release
  lsb_release -d
  2⤵
  PID:2093
- /usr/local/bin/lsb_release
  lsb_release -d
  2⤵
  PID:2093
- /usr/sbin/lsb_release
  lsb_release -d
  2⤵
  PID:2093
- /usr/bin/lsb_release
  lsb_release -d
  2⤵
  PID:2093
- - /usr/bin/getopt
    getopt --name lsb_release -o hvidrcas -l "help,version,id,description,release,codename,all,short" -- -d
    3⤵
    PID:2094
- - /usr/bin/cut
    cut -c1
    3⤵
    PID:2097
- - /usr/bin/tr
    tr "[:lower:]" "[:upper:]"
    3⤵
    PID:2098
- - /usr/bin/cut
    cut -c2-
    3⤵
    PID:2101
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2104
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2107
- /sbin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2108
- /usr/sbin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2108
- /usr/local/sbin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2108
- /usr/local/sbin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2108
- /usr/local/bin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2108
- /usr/sbin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2108
- /usr/bin/lsb_release
  lsb_release -i
  2⤵
  - System Information Discovery
  PID:2108
- - /usr/bin/getopt
    getopt --name lsb_release -o hvidrcas -l "help,version,id,description,release,codename,all,short" -- -i
    3⤵
    - System Information Discovery
    - System Network Configuration Discovery
    PID:2109
- - /usr/bin/tr
    tr "[:lower:]" "[:upper:]"
    3⤵
    PID:2113
- - /usr/bin/cut
    cut -c1
    3⤵
    PID:2112
- - /usr/bin/cut
    cut -c2-
    3⤵
    PID:2116
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2119
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2122
- /sbin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2123
- /usr/sbin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2123
- /usr/local/sbin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2123
- /usr/local/sbin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2123
- /usr/local/bin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2123
- /usr/sbin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2123
- /usr/bin/lsb_release
  lsb_release -r
  2⤵
  - System Information Discovery
  PID:2123
- - /usr/bin/getopt
    getopt --name lsb_release -o hvidrcas -l "help,version,id,description,release,codename,all,short" -- -r
    3⤵
    - System Information Discovery
    - System Network Configuration Discovery
    PID:2124
- - /usr/bin/cut
    cut -c1
    3⤵
    PID:2127
- - /usr/bin/tr
    tr "[:lower:]" "[:upper:]"
    3⤵
    PID:2128
- - /usr/bin/cut
    cut -c2-
    3⤵
    PID:2131
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2134
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2137
- /sbin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2138
- /usr/sbin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2138
- /usr/local/sbin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2138
- /usr/local/sbin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2138
- /usr/local/bin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2138
- /usr/sbin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2138
- /usr/bin/lsb_release
  lsb_release -c
  2⤵
  - System Information Discovery
  PID:2138
- - /usr/bin/getopt
    getopt --name lsb_release -o hvidrcas -l "help,version,id,description,release,codename,all,short" -- -c
    3⤵
    - System Information Discovery
    - System Network Configuration Discovery
    PID:2139
- - /usr/bin/cut
    cut -c1
    3⤵
    PID:2142
- - /usr/bin/tr
    tr "[:lower:]" "[:upper:]"
    3⤵
    PID:2143
- - /usr/bin/cut
    cut -c2-
    3⤵
    PID:2146
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2149
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2152
- /sbin/lsb_release
  lsb_release -d
  2⤵
  PID:2153
- /usr/sbin/lsb_release
  lsb_release -d
  2⤵
  PID:2153
- /usr/local/sbin/lsb_release
  lsb_release -d
  2⤵
  PID:2153
- /usr/local/sbin/lsb_release
  lsb_release -d
  2⤵
  PID:2153
- /usr/local/bin/lsb_release
  lsb_release -d
  2⤵
  PID:2153
- /usr/sbin/lsb_release
  lsb_release -d
  2⤵
  PID:2153
- /usr/bin/lsb_release
  lsb_release -d
  2⤵
  PID:2153
- - /usr/bin/getopt
    getopt --name lsb_release -o hvidrcas -l "help,version,id,description,release,codename,all,short" -- -d
    3⤵
    PID:2154
- - /usr/bin/cut
    cut -c1
    3⤵
    PID:2157
- - /usr/bin/tr
    tr "[:lower:]" "[:upper:]"
    3⤵
    PID:2158
- - /usr/bin/cut
    cut -c2-
    3⤵
    PID:2161
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2164
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:2167
- /sbin/dbus-launch
  dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
  2⤵
  PID:2172
- /usr/sbin/dbus-launch
  dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
  2⤵
  PID:2172
- /usr/local/sbin/dbus-launch
  dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
  2⤵
  PID:2172
- /usr/local/sbin/dbus-launch
  dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
  2⤵
  PID:2172
- /usr/local/bin/dbus-launch
  dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
  2⤵
  PID:2172
- /usr/sbin/dbus-launch
  dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
  2⤵
  PID:2172
- /usr/bin/dbus-launch
  dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
  2⤵
  - Reads runtime system information
  PID:2172
- - /usr/bin/dbus-daemon
    /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2174
- /bin/sh
  /bin/sh -c "\"id\" -g hexlicsrv"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:2183
- - /usr/bin/id
    id -g hexlicsrv
    3⤵
    - Reads runtime system information
    PID:2184
- /bin/sh
  /bin/sh -c "\"groupadd\" --system hexlicsrv"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:2185
- - /sbin/groupadd
    groupadd --system hexlicsrv
    3⤵
    - Modifies password files for system users/ groups
    - Reads runtime system information
    PID:2186
- /bin/sh
  /bin/sh -c "\"id\" hexlicsrv"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:2192
- - /usr/bin/id
    id hexlicsrv
    3⤵
    - Reads runtime system information
    PID:2193
- /bin/sh
  /bin/sh -c "\"useradd\" --system -g hexlicsrv hexlicsrv"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:2194
- - /sbin/useradd
    useradd --system -g hexlicsrv hexlicsrv
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:2195
- /bin/sh
  /bin/sh -c "\"id\" -gn \"hexlicsrv\""
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:2202
- - /usr/bin/id
    id -gn hexlicsrv
    3⤵
    - Reads runtime system information
    PID:2203
- /sbin/ln
  ln -sf /opt/hexlicsrv/hexlicsrv.service hexlicsrv.service
  2⤵
  PID:2204
- /usr/sbin/ln
  ln -sf /opt/hexlicsrv/hexlicsrv.service hexlicsrv.service
  2⤵
  PID:2204
- /usr/local/sbin/ln
  ln -sf /opt/hexlicsrv/hexlicsrv.service hexlicsrv.service
  2⤵
  PID:2204
- /usr/local/sbin/ln
  ln -sf /opt/hexlicsrv/hexlicsrv.service hexlicsrv.service
  2⤵
  PID:2204
- /usr/local/bin/ln
  ln -sf /opt/hexlicsrv/hexlicsrv.service hexlicsrv.service
  2⤵
  PID:2204
- /usr/sbin/ln
  ln -sf /opt/hexlicsrv/hexlicsrv.service hexlicsrv.service
  2⤵
  PID:2204
- /usr/bin/ln
  ln -sf /opt/hexlicsrv/hexlicsrv.service hexlicsrv.service
  2⤵
  PID:2204
- /bin/sh
  /bin/sh -c "\"systemctl\" daemon-reload"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:2205
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads runtime system information
    PID:2206
- /bin/sh
  /bin/sh -c "\"systemctl\" enable hexlicsrv.service"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:2340
- - /usr/bin/systemctl
    systemctl enable hexlicsrv.service
    3⤵
    - Reads runtime system information
    PID:2341

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Modify Authentication Process

T1556

Pluggable Authentication Modules

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Pluggable Authentication Modules

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Information Discovery