Malware analysis nm-inet-dialog Malicious activity | ANY.RUN

Add for printing

File name:	nm-inet-dialog
Full analysis:	https://app.any.run/tasks/bf392f80-3ea0-4019-a038-8bbf8b0e73be
Verdict:	Malicious activity
Threats:	Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth. Malware Trends Tracker >>>
Analysis date:	May 27, 2024, 16:50:51
OS:	Ubuntu 22.04.2
Tags:	miner
MIME:	application/x-executable
File info:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=4900f1057c817d78f6abf8c33793107b79dcd1a7, for GNU/Linux 2.6.32, stripped
MD5:	6F4B17764B0ADDC47EA1393C7A12C689
SHA1:	07BEB5277AEBAB37DBAC811EEE531395CF968433
SHA256:	2D96BF6E392BBD29C2D13F6393410E4599A40E1F2FE9DC8A7B744D11F05EB756
SSDEEP:	98304:UmaFSoqF+uuka/rDk0z6+qkVj4Jwf6yQaLcfO/9M7BAW1AiD+1rcNfEMSFLPRMfL:CSm4MBAH4nS8fo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executes commands using command-line interpreter
  - bash (PID: 6172)
  - nm-inet-dialog.o (PID: 6177)
- Connects to unusual port
  - nm-inet-dialog.o (PID: 6177)
- Modifies file or directory owner
  - sudo (PID: 6165)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (49.8)

EXIF

EXE

CPUArchitecture:	64 bit
CPUByteOrder:	Little endian
ObjectFileType:	Executable file
CPUType:	AMD x86-64

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

237

Monitored processes

24

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
6164	/bin/sh -c "sudo chown user /tmp/nm-inet-dialog\.o && chmod +x /tmp/nm-inet-dialog\.o && DISPLAY=:0 sudo -i /tmp/nm-inet-dialog\.o "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN
6165	sudo chown user /tmp/nm-inet-dialog.o	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN Exit code: 0
6166	chown user /tmp/nm-inet-dialog.o	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
6167	chmod +x /tmp/nm-inet-dialog.o	/usr/bin/chmod	—	sh
User: user Integrity Level: UNKNOWN Exit code: 0
6168	sudo -i /tmp/nm-inet-dialog.o	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN
6170	/tmp/nm-inet-dialog.o	/tmp/nm-inet-dialog.o	—	sudo
User: root Integrity Level: UNKNOWN
6171	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	nm-inet-dialog.o
User: root Integrity Level: UNKNOWN Exit code: 0
6172	-bash --login -c \/tmp\/nm-inet-dialog\.o	/usr/bin/bash	—	nm-inet-dialog.o
User: root Integrity Level: UNKNOWN Exit code: 0
6173	sh -c "cat /usr/etc/debuginfod/*\.urls 2>/dev/null"	/usr/bin/sh	—	bash
User: root Integrity Level: UNKNOWN Exit code: 0
6174	tr \n " "	/usr/bin/tr	—	bash
User: root Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
6170	nm-inet-dialog.o	/tmp/_MEI5XXiHY/_cffi_backend.cpython-38-x86_64-linux-gnu.so		—
		MD5:—	SHA256:—
6170	nm-inet-dialog.o	/tmp/_MEI5XXiHY/cryptography/hazmat/bindings/_constant_time.abi3.so		—
		MD5:—	SHA256:—
6170	nm-inet-dialog.o	/tmp/_MEI5XXiHY/cryptography/hazmat/bindings/_openssl.abi3.so		—
		MD5:—	SHA256:—
6170	nm-inet-dialog.o	/tmp/_MEI5XXiHY/lib-dynload/_bz2.cpython-38-x86_64-linux-gnu.so		—
		MD5:—	SHA256:—
6170	nm-inet-dialog.o	/tmp/_MEI5XXiHY/lib-dynload/_codecs_cn.cpython-38-x86_64-linux-gnu.so		—
		MD5:—	SHA256:—
6170	nm-inet-dialog.o	/tmp/_MEI5XXiHY/lib-dynload/_codecs_hk.cpython-38-x86_64-linux-gnu.so		—
		MD5:—	SHA256:—
6170	nm-inet-dialog.o	/tmp/_MEI5XXiHY/lib-dynload/_codecs_iso2022.cpython-38-x86_64-linux-gnu.so		—
		MD5:—	SHA256:—
6170	nm-inet-dialog.o	/tmp/_MEI5XXiHY/lib-dynload/_codecs_jp.cpython-38-x86_64-linux-gnu.so		—
		MD5:—	SHA256:—
6170	nm-inet-dialog.o	/tmp/_MEI5XXiHY/lib-dynload/_codecs_kr.cpython-38-x86_64-linux-gnu.so		—
		MD5:—	SHA256:—
6170	nm-inet-dialog.o	/tmp/_MEI5XXiHY/lib-dynload/_codecs_tw.cpython-38-x86_64-linux-gnu.so		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

16

DNS requests

15

Threats

2

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.48:80	http://connectivity-check.ubuntu.com/	unknown	—	—	—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.48:80	—	Canonical Group Limited	US	unknown
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.49:80	—	Canonical Group Limited	GB	unknown
—	—	91.189.91.98:80	—	Canonical Group Limited	US	unknown
—	—	212.102.56.179:443	—	Datacamp Limited	DE	unknown
1195	snap-store	195.181.175.16:443	—	Datacamp Limited	DE	unknown
6177	nm-inet-dialog.o	104.16.236.243:443	blockchain.info	CLOUDFLARENET	—	unknown
485	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
485	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
6177	nm-inet-dialog.o	51.81.56.15:3333	solo.ckpool.org	OVH SAS	US	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	2620:2d:4000:1::22 2620:2d:4000:1::2b 2620:2d:4000:1::98 2001:67c:1562::24 2620:2d:4002:1::197 2620:2d:4000:1::23 2001:67c:1562::23 2620:2d:4000:1::96 2620:2d:4000:1::2a 2620:2d:4002:1::198 2620:2d:4000:1::97 2620:2d:4002:1::196	unknown
82.100.168.192.in-addr.arpa	—	unknown
blockchain.info	104.16.236.243 104.16.237.243	unknown
solo.ckpool.org	51.81.56.15	unknown
api.snapcraft.io	185.125.188.59 185.125.188.54 185.125.188.55 185.125.188.58	unknown

Threats

PID	Process	Class	Message
—	—	Potential Corporate Privacy Violation	AV POLICY NiceHash Miner Subscribing To Pool
—	—	Crypto Currency Mining Activity Detected	ET COINMINER W32/BitCoinMiner.MultiThreat Subscribe/Authorize Stratum Protocol Message

Add for printing

No debug info

General Info

nm-inet-dialog

6F4B17764B0ADDC47EA1393C7A12C689

07BEB5277AEBAB37DBAC811EEE531395CF968433

2D96BF6E392BBD29C2D13F6393410E4599A40E1F2FE9DC8A7B744D11F05EB756

98304:UmaFSoqF+uuka/rDk0z6+qkVj4Jwf6yQaLcfO/9M7BAW1AiD+1rcNfEMSFLPRMfL:CSm4MBAH4nS8fo

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Executes commands using command-line interpreter

Connects to unusual port

Modifies file or directory owner

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings