Resubmissions

12-02-2024 18:09

240212-wrhtmsce28 10

12-02-2024 09:43

240212-lpzn9sbh65 10

12-02-2024 09:37

240212-llppwshh61 10

Analysis

  • max time kernel
    21s
  • max time network
    26s
  • platform
    macos-10.15_amd64
  • resource
    macos-20231201-en
  • resource tags

    arch:amd64arch:i386image:macos-20231201-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    12-02-2024 18:09

General

  • Target

    Mixed In Key 8.pkg

  • Size

    10.0MB

  • MD5

    66405f4bb6db1136037fde9f43830119

  • SHA1

    0898cd7a55b55853ce9da0f0f360ec31ecec4974

  • SHA256

    9e8c30955ccb5797efaab676ffdf36fe08ce32d4aab4d18e1a9ed2be43d5db0f

  • SHA512

    3c176a83742d35b10645b70db4ed2ff00b888073d0daa73c7a4ce11c88b5b2cda818b9ab1844b35192bbd2436567e186ca200432fe4ef8a377ecf4be49da3da1

  • SSDEEP

    196608:NkBu2wBiw00Bsqbxxf19Hhx7r0A8JAi2RgXuHueFrs/7M+XvEYBu:Kg2whsQrndWJAi28enS/7JXtBu

Malware Config

Signatures

  • EvilQuest

    EvilQuest family.

  • EvilQuest payload 1 IoCs
  • File Permission 1 TTPs
  • Launch Daemon 1 TTPs
  • AppleScript 1 TTPs 7 IoCs
  • Resource Forking 1 TTPs 4 IoCs
  • Command and Scripting Interpreter 1 TTPs
  • Launchctl 1 TTPs 7 IoCs

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
    1⤵
      PID:526
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
      1⤵
        PID:526
      • /usr/bin/sudo
        sudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
        1⤵
          PID:526
          • /bin/zsh
            /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
            2⤵
              PID:527
            • /usr/sbin/installer
              installer -pkg /Users/run/setup.pkg -target /
              2⤵
                PID:527
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.installd
              1⤵
                PID:547
              • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                1⤵
                  PID:547
                • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
                  /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
                  1⤵
                    PID:548
                  • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
                    /System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/3705FEBE-A619-424F-8083-E69CA7A4C9CB.activeSandbox/Root /
                    1⤵
                      PID:549
                    • /tmp/PKInstallSandbox.xTu1hK/Scripts/com.mixedinkey.installer.pPlrbu/postinstall
                      /tmp/PKInstallSandbox.xTu1hK/Scripts/com.mixedinkey.installer.pPlrbu/postinstall /Users/run/setup.pkg /Applications / /
                      1⤵
                        PID:551
                      • /bin/bash
                        /bin/sh /tmp/PKInstallSandbox.xTu1hK/Scripts/com.mixedinkey.installer.pPlrbu/postinstall /Users/run/setup.pkg /Applications / /
                        1⤵
                          PID:551
                          • /bin/mkdir
                            mkdir /Library/mixednkey
                            2⤵
                              PID:553
                            • /bin/mv
                              mv /Applications/Utils/patch /Library/mixednkey/toolroomd
                              2⤵
                                PID:554
                              • /bin/rmdir
                                rmdir /Application/Utils
                                2⤵
                                  PID:555
                                • /bin/chmod
                                  chmod +x /Library/mixednkey/toolroomd
                                  2⤵
                                    PID:556
                                  • /Library/mixednkey/toolroomd
                                    /Library/mixednkey/toolroomd
                                    2⤵
                                      PID:557
                                  • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                                    /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
                                    1⤵
                                      PID:558
                                    • /bin/sh
                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                      1⤵
                                        PID:559
                                      • /bin/bash
                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                        1⤵
                                          PID:559
                                        • /bin/sh
                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                          1⤵
                                            PID:560
                                          • /bin/bash
                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                            1⤵
                                              PID:560
                                            • /bin/sh
                                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                              1⤵
                                                PID:563
                                              • /bin/bash
                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                1⤵
                                                  PID:563
                                                • /bin/sh
                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                  1⤵
                                                    PID:564
                                                  • /bin/bash
                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                    1⤵
                                                      PID:564
                                                    • /bin/sh
                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                      1⤵
                                                        PID:565
                                                      • /bin/bash
                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                        1⤵
                                                          PID:565
                                                        • /bin/sh
                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                          1⤵
                                                            PID:567
                                                          • /bin/bash
                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                            1⤵
                                                              PID:567
                                                            • /usr/libexec/xpcproxy
                                                              xpcproxy com.apple.pbs
                                                              1⤵
                                                                PID:568
                                                              • /bin/sh
                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                1⤵
                                                                  PID:569
                                                                • /bin/bash
                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                  1⤵
                                                                    PID:569

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • /Library/AppQuest/com.apple.questd

                                                                    Filesize

                                                                    85KB

                                                                    MD5

                                                                    322f4fb8f257a2e651b128c41df92b1d

                                                                    SHA1

                                                                    efbb681a61967e6f5a811f8649ec26efe16f50ae

                                                                    SHA256

                                                                    5a024ffabefa6082031dccdb1e74a7fec9f60f257cd0b1ab0f698ba2a5baca6b

                                                                    SHA512

                                                                    33c8cf815e4b37a3481c0ba4dfb14a4735a46575f6f70d5b351a8595e4ec8886224577c89c80d726f2e3d7cf2460d0cdd983379acb5fda0a9b7310f86c988e53

                                                                  • /Library/InstallerSandboxes/.PKInstallSandboxManager/3705FEBE-A619-424F-8083-E69CA7A4C9CB.activeSandbox/Boms/com.mixedinkey.installer.bom

                                                                    Filesize

                                                                    99KB

                                                                    MD5

                                                                    0f07cb15d467adba0a80120ef583d92c

                                                                    SHA1

                                                                    9a66033fcbbd2c4a4ad82d173b7d686febcd7509

                                                                    SHA256

                                                                    977d7b35b060620e979cd8337ef0e4972afc08388986354b7a6b57763d0450d4

                                                                    SHA512

                                                                    e681f21eb24279dd9bf4f9c9f339f075e6e948d497fb42c4bf614425c4c62bae8fb9e71d9efc61a50f3d6957c211aaebbc20d36836a0d212d96950c252f93561

                                                                  • /Library/InstallerSandboxes/.PKInstallSandboxManager/3705FEBE-A619-424F-8083-E69CA7A4C9CB.activeSandbox/Scripts/com.mixedinkey.installer.pPlrbu//Scripts/._postinstall__

                                                                    Filesize

                                                                    82B

                                                                    MD5

                                                                    5f57248f8a15969f55f716d8e7ce1447

                                                                    SHA1

                                                                    2daf28e0b224464534eecc6576c5b87e05cad4a7

                                                                    SHA256

                                                                    03ee1b034d79af0d5bc807f1560e7ffd5554ff56fcf29a47b3ac5db4f7fa4eb5

                                                                    SHA512

                                                                    2d9a3e97a5b991d9d22ef5e008f1828b9a7f8b8aa35111250edf45f9ed3f772378119f2a8c18cf5d1141f34d0b04200eadc7b75f1aaa57e0c15083c28f73c5c7

                                                                  • /Library/LaunchDaemons/com.apple.questd.plist

                                                                    Filesize

                                                                    435B

                                                                    MD5

                                                                    a3d34532a7dd2cd1d73cea75deb0677f

                                                                    SHA1

                                                                    3019d1c50907fb2597121c03619990c5670ff6f4

                                                                    SHA256

                                                                    779a31e4de99f9de28de8bf064c504382e050c114e2e865cc1f694c7e6339735

                                                                    SHA512

                                                                    52618a5f14247c909a3857b122a124d0ddd00890c128cf041976182423b3d728cab11daf5b6a1adb6845d062b54083e72380184b6f76369482305c2782bedd91

                                                                  • /Users/run/Library/LaunchAgents/com.apple.questd.plist

                                                                    Filesize

                                                                    423B

                                                                    MD5

                                                                    eb73619f4e724257ff0fd951883a30ae

                                                                    SHA1

                                                                    5032251e50b32e340d8171631a598596bad8991e

                                                                    SHA256

                                                                    6e56467f3f5502588094c91e2d58bbb1e43c4e8171093db14931dd41788e17d4

                                                                    SHA512

                                                                    ec95c395414181bc77c7a2980fbd3fe69b718aa98c878e514c3f28b738e1669488126cbdfa96e3a182afd8536b54bc1791a044fa3535d1fd3fad54dfda337b7c

                                                                  • /private/var/run/installd.commit.pid

                                                                    Filesize

                                                                    3B

                                                                    MD5

                                                                    c75b6f114c23a4d7ea11331e7c00e73c

                                                                    SHA1

                                                                    3219b5be78da72e80e0918d458b9ece3825a68e1

                                                                    SHA256

                                                                    fadb19bfbddde11ed6828a22e742cc97f5589ce48ac8ec8f94a6510ad5f16b8b

                                                                    SHA512

                                                                    ef55732bbcf0f2ba4d2c29de31cbb85eedf5604aad2136b78c229c14f705b49c6ba1548b1398f701e9ecf321b9059d9cbffc5da58e8debf8dd7f002e679c1d12

                                                                  • /tmp/PKInstallSandbox.xTu1hK/Scripts/com.mixedinkey.installer.pPlrbu/postinstall

                                                                    Filesize

                                                                    190B

                                                                    MD5

                                                                    03fc4e3ef9bdbccd7ea68537970ce472

                                                                    SHA1

                                                                    7cc289badfe38c5677175fa38810e0e18c51e1d3

                                                                    SHA256

                                                                    abcce423690c96a06414f68090db40cbdaee12b67f90d1ca64bddbdc1d11d097

                                                                    SHA512

                                                                    6f089d9c977fabc18e0a599c8239200031b6eeed1fbbd2f8197bb82e7cdd8f695b220902bef49276c6b1ca8784ebc3503aba841146a4ce36b1b571703e832bf1