Overview

overview

4

Static

static

3

ICQLiteShell.dll

macos-10.15-amd64

ICQRT.dll

macos-10.15-amd64

4

Language/WinRar.exe

macos-10.15-amd64

1

LiteRes.dll

macos-10.15-amd64

1

LiteSkinUtils.dll

macos-10.15-amd64

1

setup.exe

macos-10.15-amd64

1

Resubmissions

23/02/2024, 19:43

240223-ye8kmsgf7s4

23/02/2024, 19:34

240223-yacx6sff3910

Analysis

  • max time kernel
    147s
  • max time network
    157s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240214-en
  • resource tags

    arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    23/02/2024, 19:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ICQRT.dll
  • Size 32KB
  • Sample240223-ye8kmsgf7s
  • SHA256 53e1f40144bab532f9700ff25ec3d5c6a39784a98e17fada583b4ee6d9dd5dbc
  • MD5 SHA1 SHA512 SSDEEP
Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 2 IoCs
    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/ICQRT.dll\""
    1⤵
      PID:544
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/ICQRT.dll\""
      1⤵
        PID:544
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/ICQRT.dll
        1⤵
          PID:544
          • /bin/zsh
            /bin/zsh -c /Users/run/ICQRT.dll
            2⤵
              PID:545
            • /Users/run/ICQRT.dll
              /Users/run/ICQRT.dll
              2⤵
                PID:545
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.sysmond
              1⤵
                PID:547
              • /usr/libexec/sysmond
                /usr/libexec/sysmond
                1⤵
                  PID:547
                • /usr/bin/pluginkit
                  /usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
                  1⤵
                    PID:565
                  • /usr/sbin/spctl
                    /usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterDA6CE80A/OneDrive.app
                    1⤵
                      PID:566
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.nehelper
                      1⤵
                        PID:570
                      • /usr/libexec/nehelper
                        /usr/libexec/nehelper
                        1⤵
                          PID:570
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.audio.systemsoundserverd
                          1⤵
                            PID:571
                          • /usr/sbin/systemsoundserverd
                            /usr/sbin/systemsoundserverd
                            1⤵
                              PID:571
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.geod
                              1⤵
                                PID:576
                              • /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
                                /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
                                1⤵
                                  PID:576
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.Safari.2028
                                  1⤵
                                    PID:579
                                  • /Applications/Safari.app/Contents/MacOS/Safari
                                    /Applications/Safari.app/Contents/MacOS/Safari
                                    1⤵
                                      PID:579
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.Safari.History
                                      1⤵
                                        PID:580
                                      • /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
                                        /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
                                        1⤵
                                          PID:580
                                        • /usr/libexec/xpcproxy
                                          xpcproxy com.apple.siri.context.service
                                          1⤵
                                            PID:582
                                          • /System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
                                            /System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
                                            1⤵
                                              PID:582
                                            • /usr/libexec/xpcproxy
                                              xpcproxy com.apple.WebKit.WebContent.E324B18A-E0C8-4FD1-96FA-7F075F1EEDF2 579
                                              1⤵
                                                PID:583
                                              • /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                                                /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                                                1⤵
                                                  PID:583
                                                • /usr/libexec/xpcproxy
                                                  xpcproxy com.apple.SafariLaunchAgent
                                                  1⤵
                                                    PID:588
                                                  • /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
                                                    /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
                                                    1⤵
                                                      PID:588
                                                    • /usr/libexec/xpcproxy
                                                      xpcproxy com.apple.CoreAuthentication.agent
                                                      1⤵
                                                        PID:589
                                                      • /System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
                                                        /System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
                                                        1⤵
                                                          PID:589
                                                        • /usr/libexec/xpcproxy
                                                          xpcproxy com.apple.akd
                                                          1⤵
                                                            PID:590
                                                          • /System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
                                                            /System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
                                                            1⤵
                                                              PID:590
                                                            • /usr/libexec/xpcproxy
                                                              xpcproxy com.apple.WebKit.WebContent.58A28738-EF4D-4E5B-94B6-637F01C734A0 579
                                                              1⤵
                                                                PID:591
                                                              • /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                                                                /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                                                                1⤵
                                                                  PID:591
                                                                • /usr/libexec/xpcproxy
                                                                  xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
                                                                  1⤵
                                                                    PID:592
                                                                  • /usr/libexec/neagent
                                                                    /usr/libexec/neagent
                                                                    1⤵
                                                                      PID:592
                                                                    • /usr/libexec/xpcproxy
                                                                      xpcproxy com.apple.Safari.SearchHelper 579
                                                                      1⤵
                                                                        PID:593
                                                                      • /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
                                                                        /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
                                                                        1⤵
                                                                          PID:593
                                                                        • /usr/libexec/xpcproxy
                                                                          xpcproxy com.apple.pbs
                                                                          1⤵
                                                                            PID:594
                                                                          • /System/Library/CoreServices/pbs
                                                                            /System/Library/CoreServices/pbs
                                                                            1⤵
                                                                              PID:594
                                                                            • /usr/libexec/xpcproxy
                                                                              xpcproxy com.apple.Safari.SafeBrowsing.Service
                                                                              1⤵
                                                                                PID:595
                                                                              • /System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
                                                                                /System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
                                                                                1⤵
                                                                                  PID:595
                                                                                • /usr/libexec/xpcproxy
                                                                                  xpcproxy com.apple.WebKit.WebContent.769285D1-38BE-4702-9E74-1C9B06EAD9C7 579
                                                                                  1⤵
                                                                                    PID:598
                                                                                  • /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                                                                                    /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                                                                                    1⤵
                                                                                      PID:598
                                                                                    • /usr/libexec/xpcproxy
                                                                                      xpcproxy com.apple.AddressBook.ContactsAccountsService
                                                                                      1⤵
                                                                                        PID:599
                                                                                      • /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
                                                                                        /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
                                                                                        1⤵
                                                                                          PID:599
                                                                                        • /usr/libexec/xpcproxy
                                                                                          xpcproxy com.apple.routined
                                                                                          1⤵
                                                                                            PID:604
                                                                                          • /usr/libexec/routined
                                                                                            /usr/libexec/routined LAUNCHED_BY_LAUNCHD
                                                                                            1⤵
                                                                                              PID:604
                                                                                            • /usr/libexec/xpcproxy
                                                                                              xpcproxy com.apple.Maps.mapspushd
                                                                                              1⤵
                                                                                                PID:605
                                                                                              • /System/Library/CoreServices/mapspushd
                                                                                                /System/Library/CoreServices/mapspushd
                                                                                                1⤵
                                                                                                  PID:605
                                                                                                • /usr/libexec/xpcproxy
                                                                                                  xpcproxy com.apple.knowledge-agent
                                                                                                  1⤵
                                                                                                    PID:606
                                                                                                  • /usr/libexec/knowledge-agent
                                                                                                    /usr/libexec/knowledge-agent
                                                                                                    1⤵
                                                                                                      PID:606
                                                                                                    • /usr/libexec/xpcproxy
                                                                                                      xpcproxy com.apple.tailspind
                                                                                                      1⤵
                                                                                                        PID:607
                                                                                                      • /usr/libexec/tailspind
                                                                                                        /usr/libexec/tailspind
                                                                                                        1⤵
                                                                                                          PID:607
                                                                                                        • /usr/libexec/xpcproxy
                                                                                                          xpcproxy com.apple.ReportCrash.Root
                                                                                                          1⤵
                                                                                                            PID:608
                                                                                                          • /System/Library/CoreServices/ReportCrash
                                                                                                            /System/Library/CoreServices/ReportCrash daemon
                                                                                                            1⤵
                                                                                                              PID:608
                                                                                                            • /usr/libexec/xpcproxy
                                                                                                              xpcproxy com.apple.AppStore.1900
                                                                                                              1⤵
                                                                                                                PID:609
                                                                                                              • /System/Applications/App Store.app/Contents/MacOS/App Store
                                                                                                                "/System/Applications/App Store.app/Contents/MacOS/App Store"
                                                                                                                1⤵
                                                                                                                  PID:609
                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                  xpcproxy com.apple.ReportMemoryException
                                                                                                                  1⤵
                                                                                                                    PID:610
                                                                                                                  • /usr/libexec/ReportMemoryException
                                                                                                                    /usr/libexec/ReportMemoryException
                                                                                                                    1⤵
                                                                                                                      PID:610
                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                      xpcproxy com.apple.storeuid
                                                                                                                      1⤵
                                                                                                                        PID:611
                                                                                                                      • /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
                                                                                                                        /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
                                                                                                                        1⤵
                                                                                                                          PID:611
                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                          xpcproxy com.apple.adid
                                                                                                                          1⤵
                                                                                                                            PID:612
                                                                                                                          • /System/Library/PrivateFrameworks/CoreADI.framework/adid
                                                                                                                            /System/Library/PrivateFrameworks/CoreADI.framework/adid
                                                                                                                            1⤵
                                                                                                                              PID:612
                                                                                                                            • /usr/libexec/xpcproxy
                                                                                                                              xpcproxy com.apple.security.cloudkeychainproxy3
                                                                                                                              1⤵
                                                                                                                                PID:613
                                                                                                                              • /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
                                                                                                                                /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
                                                                                                                                1⤵
                                                                                                                                  PID:613
                                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                                  xpcproxy com.apple.PerformanceAnalysis.animationperfd
                                                                                                                                  1⤵
                                                                                                                                    PID:614
                                                                                                                                  • /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                                                                                                                                    /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                                                                                                                                    1⤵
                                                                                                                                      PID:614
                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                      xpcproxy com.apple.coremedia.videodecoder 609
                                                                                                                                      1⤵
                                                                                                                                        PID:615
                                                                                                                                      • /System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
                                                                                                                                        /System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
                                                                                                                                        1⤵
                                                                                                                                          PID:615

                                                                                                                                        Network

                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              com.apple.networkextension.uuidcache.plist
                                                                                                                                              • Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
                                                                                                                                              • Size 288B
                                                                                                                                              • SHA256 04fefbaa058a5c300a90a50be6894dde2138fa47239dd93e7b9265352a96e4eb
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              com.apple.networkextension.uuidcache.plist
                                                                                                                                              • Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
                                                                                                                                              • Size 351B
                                                                                                                                              • SHA256 e345cd848b7d6c0fca957a1a87190f397d7723d35bb405553295b383b3b70e83
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              com.apple.networkextension.uuidcache.plist
                                                                                                                                              • Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
                                                                                                                                              • Size 351B
                                                                                                                                              • SHA256 a7264cf964a0c27328b5e235b6942e3db3ab72bfeb6ad155373c38811b33f7c8
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              com.apple.networkextension.uuidcache.plist
                                                                                                                                              • Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
                                                                                                                                              • Size 381B
                                                                                                                                              • SHA256 90a0373d471968a8208e7ee0f5ee89f681e2078de199737f6c4bd9210476fbde
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              com.apple.networkextension.uuidcache.plist
                                                                                                                                              • Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
                                                                                                                                              • Size 381B
                                                                                                                                              • SHA256 45b6028b88f774baf7a9c00d2c009c7bdca28f4d236b641535dbf31a566919a1
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              ActiveTileGroup.pbd
                                                                                                                                              • Path /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
                                                                                                                                              • Size 124KB
                                                                                                                                              • SHA256 77684c30fc25761612d698656d317660fea30daedf8749dd78fc4912ffc367dd
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                              Submit Download

                                                                                                                                              altitude-1168.xml
                                                                                                                                              • Path /Users/run/Library/Caches/GeoServices/Resources/altitude-1168.xml
                                                                                                                                              • Size 150KB
                                                                                                                                              • SHA256 aaa9febe98e3a75220b4933d1f00f2bef276183491e7d171fa54d03259812759
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                              Submit Download

                                                                                                                                              2529545429CE075A4E64DE7DAA3D4C27
                                                                                                                                              • Path /Users/run/Library/Safari/Favicon Cache/favicons/2529545429CE075A4E64DE7DAA3D4C27
                                                                                                                                              • Size 5KB
                                                                                                                                              • SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                              Submit Download

                                                                                                                                              malware,osx,url_expression
                                                                                                                                              • Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression
                                                                                                                                              • Size 223KB
                                                                                                                                              • SHA256 43d4adeb6880085c2296110b39098bfdd1c53a32e6fdc77017b86352415fea19
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                              Submit Download

                                                                                                                                              social_engineering,osx,url_expression
                                                                                                                                              • Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression
                                                                                                                                              • Size 3.9MB
                                                                                                                                              • SHA256 4bc6b308a2f9fad57379ba54fa9af94153aa2b36216500ff86c4e0ec6cf79b29
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                              Submit Download

                                                                                                                                              unwanted_software,osx,url_expression
                                                                                                                                              • Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression
                                                                                                                                              • Size 1.3MB
                                                                                                                                              • SHA256 db1e9caf3edbcd1c5cfa59de98c1d3c4af1eef4d7a8e4aa86287ed13d3a10fc3
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                              Submit Download

                                                                                                                                              mdsDirectory.db
                                                                                                                                              • Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsDirectory.db
                                                                                                                                              • Size 47KB
                                                                                                                                              • SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                              Submit Download

                                                                                                                                              mdsObject.db
                                                                                                                                              • Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsObject.db
                                                                                                                                              • Size 4KB
                                                                                                                                              • SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                              Submit Download