Overview

overview

4

Static

static

1

RobloxPlay...er.exe

macos-10.15-amd64

4

Analysis

  • max time kernel
    146s
  • max time network
    125s
  • platform
    macos-10.15_amd64
  • resource
    macos-20231201-en
  • resource tags

    arch:amd64arch:i386image:macos-20231201-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    13-02-2024 21:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RobloxPlayerInstaller.exe

  • Size

    4.5MB

  • MD5

    c9c89a5180728704d9fc8b10fcfa5124

  • SHA1

    6eb7edac4c879645641394eb20db3cf707019b47

  • SHA256

    0e774f8533566b6221fdd374f4f6f30551f4e6aeb4848521445d15158f029855

  • SHA512

    98fbac35cbfff889ffb7a9b26684aee196237a54a9548285c233c2abf0a6a1f7588eb28d166a3a32e103f974418a7e75477cc699e5f0c8e3e290916b44ffc220

  • SSDEEP

    98304:Smvn+iSkszLaY6ZZBrKv0Log5yGj06VuXJ+2npsbLfNzt:P+iBsGZ7KngtE+YK3fdt

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 5 IoCs
    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/RobloxPlayerInstaller.exe\""
    1⤵
      PID:518
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/RobloxPlayerInstaller.exe\""
      1⤵
        PID:518
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/RobloxPlayerInstaller.exe
        1⤵
          PID:518
          • /bin/zsh
            /bin/zsh -c /Users/run/RobloxPlayerInstaller.exe
            2⤵
              PID:519
            • /Users/run/RobloxPlayerInstaller.exe
              /Users/run/RobloxPlayerInstaller.exe
              2⤵
                PID:519
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.audio.systemsoundserverd
              1⤵
                PID:543
              • /usr/sbin/systemsoundserverd
                /usr/sbin/systemsoundserverd
                1⤵
                  PID:543
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.pbs
                  1⤵
                    PID:544
                  • /System/Library/CoreServices/pbs
                    /System/Library/CoreServices/pbs
                    1⤵
                      PID:544
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.audio.AudioComponentRegistrar
                      1⤵
                        PID:545
                      • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                        /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                        1⤵
                          PID:545
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.spindump
                          1⤵
                            PID:547
                          • /usr/sbin/spindump
                            /usr/sbin/spindump
                            1⤵
                              PID:547
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.spindump_agent
                              1⤵
                                PID:548
                              • /usr/libexec/spindump_agent
                                /usr/libexec/spindump_agent
                                1⤵
                                  PID:548
                                • /usr/sbin/spctl
                                  /usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
                                  1⤵
                                    PID:565
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.quicklook.ui.helper
                                    1⤵
                                      PID:570
                                    • /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                      /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                      1⤵
                                        PID:570
                                      • /usr/libexec/xpcproxy
                                        xpcproxy "com.apple.xpc.launchd.oneshot.0x10000002.Archive Utility"
                                        1⤵
                                          PID:571
                                        • /System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
                                          "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility" -psn_0_176171
                                          1⤵
                                            PID:571
                                          • /usr/libexec/xpcproxy
                                            xpcproxy com.apple.XprotectFramework.AnalysisService 528
                                            1⤵
                                              PID:572
                                            • /System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
                                              /System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
                                              1⤵
                                                PID:572
                                              • /usr/bin/macbinary
                                                /usr/bin/macbinary probe --verbose /Users/run/Desktop/payload.zip
                                                1⤵
                                                  PID:574
                                                • /usr/bin/file
                                                  /usr/bin/file -b /Users/run/Desktop/payload.zip
                                                  1⤵
                                                    PID:575
                                                  • /usr/libexec/xpcproxy
                                                    xpcproxy com.apple.archiveutility.auhelperservice 571
                                                    1⤵
                                                      PID:576
                                                    • /System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
                                                      "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService"
                                                      1⤵
                                                        PID:576
                                                      • /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
                                                        /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
                                                        1⤵
                                                          PID:578
                                                        • /usr/libexec/xpcproxy
                                                          xpcproxy com.apple.appkit.xpc.sandboxedServiceRunner 571
                                                          1⤵
                                                            PID:579
                                                          • /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
                                                            /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
                                                            1⤵
                                                              PID:579
                                                            • /usr/libexec/xpcproxy
                                                              xpcproxy com.apple.ReportMemoryException
                                                              1⤵
                                                                PID:580
                                                              • /usr/libexec/ReportMemoryException
                                                                /usr/libexec/ReportMemoryException
                                                                1⤵
                                                                  PID:580
                                                                • /usr/libexec/xpcproxy
                                                                  xpcproxy com.apple.quicklook.satellite.D2073309-6326-43C6-A551-7F0897A18BA0 581
                                                                  1⤵
                                                                    PID:582
                                                                  • /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
                                                                    /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
                                                                    1⤵
                                                                      PID:582
                                                                    • /usr/libexec/xpcproxy
                                                                      xpcproxy com.apple.quicklook.ui.helper
                                                                      1⤵
                                                                        PID:583
                                                                      • /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                                        /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                                        1⤵
                                                                          PID:583
                                                                        • /usr/libexec/xpcproxy
                                                                          xpcproxy com.apple.xpc.launchd.oneshot.0x10000003.TextEdit
                                                                          1⤵
                                                                            PID:584
                                                                          • /System/Applications/TextEdit.app/Contents/MacOS/TextEdit
                                                                            /System/Applications/TextEdit.app/Contents/MacOS/TextEdit -psn_0_184365
                                                                            1⤵
                                                                              PID:584
                                                                            • /usr/libexec/xpcproxy
                                                                              xpcproxy com.apple.helpviewer.1332
                                                                              1⤵
                                                                                PID:587
                                                                              • /System/Library/CoreServices/HelpViewer.app/Contents/MacOS/HelpViewer
                                                                                /System/Library/CoreServices/HelpViewer.app/Contents/MacOS/HelpViewer
                                                                                1⤵
                                                                                  PID:587
                                                                                • /usr/libexec/xpcproxy
                                                                                  xpcproxy com.apple.PerformanceAnalysis.animationperfd
                                                                                  1⤵
                                                                                    PID:590
                                                                                  • /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                                                                                    /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                                                                                    1⤵
                                                                                      PID:590
                                                                                    • /usr/libexec/xpcproxy
                                                                                      xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                                                                                      1⤵
                                                                                        PID:591
                                                                                      • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                                        /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                                        1⤵
                                                                                          PID:591
                                                                                        • /usr/libexec/xpcproxy
                                                                                          xpcproxy com.apple.quicklook.ui.helper
                                                                                          1⤵
                                                                                            PID:592
                                                                                          • /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                                                            /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                                                            1⤵
                                                                                              PID:592
                                                                                            • /usr/libexec/xpcproxy
                                                                                              xpcproxy com.apple.xpc.launchd.oneshot.0x10000004.TextEdit
                                                                                              1⤵
                                                                                                PID:593
                                                                                              • /System/Applications/TextEdit.app/Contents/MacOS/TextEdit
                                                                                                /System/Applications/TextEdit.app/Contents/MacOS/TextEdit -psn_0_196656
                                                                                                1⤵
                                                                                                  PID:593
                                                                                                • /usr/libexec/xpcproxy
                                                                                                  xpcproxy com.apple.metadata.mdwrite
                                                                                                  1⤵
                                                                                                    PID:594
                                                                                                  • /bin/launchctl
                                                                                                    /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                                                                                                    1⤵
                                                                                                      PID:597
                                                                                                    • /bin/launchctl
                                                                                                      /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                                                                                                      1⤵
                                                                                                        PID:598
                                                                                                      • /usr/libexec/xpcproxy
                                                                                                        xpcproxy com.apple.printtool.agent
                                                                                                        1⤵
                                                                                                          PID:599
                                                                                                        • /System/Library/Frameworks/ApplicationServices.framework/Frameworks/PrintCore.framework/Versions/A/printtool
                                                                                                          /System/Library/Frameworks/ApplicationServices.framework/Frameworks/PrintCore.framework/Versions/A/printtool
                                                                                                          1⤵
                                                                                                            PID:599
                                                                                                          • /usr/libexec/xpcproxy
                                                                                                            xpcproxy com.apple.quicklook.ui.helper
                                                                                                            1⤵
                                                                                                              PID:601
                                                                                                            • /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                                                                              /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                                                                              1⤵
                                                                                                                PID:601
                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                xpcproxy com.apple.AppStore.1900
                                                                                                                1⤵
                                                                                                                  PID:602
                                                                                                                • /System/Applications/App Store.app/Contents/MacOS/App Store
                                                                                                                  "/System/Applications/App Store.app/Contents/MacOS/App Store"
                                                                                                                  1⤵
                                                                                                                    PID:602
                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                    xpcproxy com.apple.storeuid
                                                                                                                    1⤵
                                                                                                                      PID:603
                                                                                                                    • /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
                                                                                                                      /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
                                                                                                                      1⤵
                                                                                                                        PID:603

                                                                                                                      Network

                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      • /Users/run/Desktop/payload/happymeal
                                                                                                                        Filesize

                                                                                                                        3.0MB

                                                                                                                        MD5

                                                                                                                        99dff03efa48de8de43ad79e15913822

                                                                                                                        SHA1

                                                                                                                        b6f949342609eb5daba090d31478d70eb7851390

                                                                                                                        SHA256

                                                                                                                        a13195f61cb2cd118a2a9f77549f32ede4b4da60d3646e8e7810e705e47f03d4

                                                                                                                        SHA512

                                                                                                                        72e31be3d11c6892dbbe4ced4e38cfebd1b1a04ab46682e430ca2e0998585f00bf81ffb130d3e4aac5ac324c43d2f4b662941ed1a560704cacb8c639b3dcede1

                                                                                                                        Download Submit

                                                                                                                      • /Users/run/Desktop/payload/happymeal
                                                                                                                        Filesize

                                                                                                                        464KB

                                                                                                                        MD5

                                                                                                                        c613abbf36d47abf30f9fb89842228d2

                                                                                                                        SHA1

                                                                                                                        55c7396c57c725a7a81f6dc7de25c95e6f4ea28a

                                                                                                                        SHA256

                                                                                                                        937a356457648d503d9da202aa94e59fb4da105ec1f5979cb337c2175f312a18

                                                                                                                        SHA512

                                                                                                                        8a48c82720cbc5ab49a6bb1a3721670be270241a5036df73b409fd4ca8a126634b062262698999e762d82703cd653ccfc35c57b1508a0a5d947bb6bf20fc1781

                                                                                                                        Download Submit

                                                                                                                      • /Users/run/Desktop/payload/happymeal
                                                                                                                        Filesize

                                                                                                                        3.4MB

                                                                                                                        MD5

                                                                                                                        176fd682841c1bf121d5d31ed4e79ff6

                                                                                                                        SHA1

                                                                                                                        4cef56665caa85e9ea0c6cea82b1bd7fb3c93392

                                                                                                                        SHA256

                                                                                                                        9660253445f7637d98d663c855a9c18a59e921de127df607e1781d2b57486431

                                                                                                                        SHA512

                                                                                                                        34bcdc43bf91af165df72f49f73cbdaedf0e02daa272ce4e19cbf2db00ad203879c02f90626d75299d4d87628bf8a8d3c5ea8ffb013e43f1a8070e107c16e068

                                                                                                                        Download Submit

                                                                                                                      • /Users/run/Desktop/payload/happymeal
                                                                                                                        Filesize

                                                                                                                        1.0MB

                                                                                                                        MD5

                                                                                                                        925cdb57ad3218ad22e093b725aaec24

                                                                                                                        SHA1

                                                                                                                        caa2170a4aee30be5f2553c1716bfe90456f9d1f

                                                                                                                        SHA256

                                                                                                                        8e8ae57e3afbf4858671fa474e44b753fb347ae5bbbd9666b1d098948a70d555

                                                                                                                        SHA512

                                                                                                                        0481e84708753bcb9edff34645dc40fdf079d382505b3c12469d1b2ff1a907dd153de68dcda1029d08bd2af5de8f61ff342de0297ce79bc8c63f2712be88340b

                                                                                                                        Download Submit

                                                                                                                      • /Users/run/Desktop/payload/happymeal
                                                                                                                        Filesize

                                                                                                                        777KB

                                                                                                                        MD5

                                                                                                                        4b0375d35599172ddae33beb36f6feab

                                                                                                                        SHA1

                                                                                                                        70cd26d84a993bf0b9a46a9374243321eace3eb8

                                                                                                                        SHA256

                                                                                                                        3f13854352da8ef4658b12d0335531252544a9c128b7f1d9efc3df7ea91d5f8d

                                                                                                                        SHA512

                                                                                                                        c87d171576942967cc9036a1e89f521abe9f4d4525d7d59eb3c35b83cd28fec84a49fbcf6db46e254586e275215ed12bda470cf36301a862ba3b4002f5bd3610

                                                                                                                        Download Submit

                                                                                                                      • /Users/run/Desktop/payload/settings.json
                                                                                                                        Filesize

                                                                                                                        478B

                                                                                                                        MD5

                                                                                                                        b35182a5d0722d6f81654bbf9755bb77

                                                                                                                        SHA1

                                                                                                                        05203798855cfdf6f32161189ee340efe27386fb

                                                                                                                        SHA256

                                                                                                                        f9169b9b0d3706f8622513a6be8a722cdcef97826f1e71476439cb387792416c

                                                                                                                        SHA512

                                                                                                                        584f5d1afd86c2492a344447039c34b2239903af5b27590371226a13bc8668afa106af8bbefcfd75ed61a247ab251c93c51ce8192347b6d5ac53bf2b44bf89f9

                                                                                                                        Download Submit

                                                                                                                      • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
                                                                                                                        Filesize

                                                                                                                        47KB

                                                                                                                        MD5

                                                                                                                        0e4a0d1ceb2af6f0f8d0167ce77be2d3

                                                                                                                        SHA1

                                                                                                                        414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

                                                                                                                        SHA256

                                                                                                                        cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

                                                                                                                        SHA512

                                                                                                                        1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

                                                                                                                        Download Submit

                                                                                                                      • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        MD5

                                                                                                                        d3a1859e6ec593505cc882e6def48fc8

                                                                                                                        SHA1

                                                                                                                        f8e6728e3e9de477a75706faa95cead9ce13cb32

                                                                                                                        SHA256

                                                                                                                        3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

                                                                                                                        SHA512

                                                                                                                        ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

                                                                                                                        Download Submit