Overview

overview

10

Static

static

1

2a9296ac99...caab5f

macos-10.15-amd64

10

Analysis

  • max time kernel
    146s
  • max time network
    145s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240410-en
  • resource tags

    arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    10-04-2024 10:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f

  • Size

    713KB

  • MD5

    23699799f496b8e872d05f19d2b397f8

  • SHA1

    fe3a3e65b86d2b07654f9a6104c8cb392c88b7e8

  • SHA256

    2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f

  • SHA512

    f347c47afe06ed7ef2a71b7e40ac0103f4f33e26250661173775b349bba7452ea458e5d4137a57b34801556959bca14093a9f693d59c147061f63f2b78614288

  • SSDEEP

    6144:0RDkTCDC628O+i5Npv56/SfQ7WXIRPeTqiKjBAaIeuLkN04b1Z2O/a0csN2oGA8s:q5o657MOPhKCuo64b//nPpA/OGg2Y5

Score
10/10
gimmickbackdoorexecutionpersistence

Malware Config

Signatures

  • Gimmick

    Gimmick family.

    backdoorgimmick
  • Launch Daemon 1 TTPs

    Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

    persistence
  • Launchctl 1 TTPs 4 IoCs

    Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

    execution

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f\""
    1⤵
      PID:476
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f\""
      1⤵
        PID:476
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f
        1⤵
          PID:476
          • /bin/zsh
            /bin/zsh -c /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f
            2⤵
              PID:477
            • /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f
              /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f
              2⤵
                PID:477
            • /bin/sh
              sh -c "ps -ef |grep CorelDRAW |grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f |grep -v 'CorelDRAW\\s*Graphics\\s*Suite' |awk '{print \$2}' |xargs kill -9"
              1⤵
                PID:478
              • /bin/bash
                sh -c "ps -ef |grep CorelDRAW |grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f |grep -v 'CorelDRAW\\s*Graphics\\s*Suite' |awk '{print \$2}' |xargs kill -9"
                1⤵
                  PID:478
                  • /bin/ps
                    ps -ef
                    2⤵
                      PID:479
                    • /usr/bin/grep
                      grep CorelDRAW
                      2⤵
                        PID:480
                      • /usr/bin/grep
                        grep -v "CorelDRAW\\s*Graphics\\s*Suite"
                        2⤵
                          PID:482
                        • /usr/bin/grep
                          grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f
                          2⤵
                            PID:481
                          • /usr/bin/awk
                            awk "{print \$2}"
                            2⤵
                              PID:483
                            • /usr/bin/xargs
                              xargs kill -9
                              2⤵
                                PID:484
                            • /usr/bin/kill
                              kill -9 480 482
                              1⤵
                                PID:485
                              • /bin/kill
                                kill -9 480 482
                                1⤵
                                  PID:485
                                • /bin/sh
                                  sh -c "ps -ef |grep CorelDRAW |grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f |grep -v 'CorelDRAW\\s*Graphics\\s*Suite' |awk '{print \$2}' |xargs kill -9"
                                  1⤵
                                    PID:486
                                  • /bin/bash
                                    sh -c "ps -ef |grep CorelDRAW |grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f |grep -v 'CorelDRAW\\s*Graphics\\s*Suite' |awk '{print \$2}' |xargs kill -9"
                                    1⤵
                                      PID:486
                                      • /bin/ps
                                        ps -ef
                                        2⤵
                                          PID:487
                                        • /usr/bin/grep
                                          grep CorelDRAW
                                          2⤵
                                            PID:488
                                          • /usr/bin/grep
                                            grep -v /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f
                                            2⤵
                                              PID:489
                                            • /usr/bin/grep
                                              grep -v "CorelDRAW\\s*Graphics\\s*Suite"
                                              2⤵
                                                PID:490
                                              • /usr/bin/awk
                                                awk "{print \$2}"
                                                2⤵
                                                  PID:491
                                                • /usr/bin/xargs
                                                  xargs kill -9
                                                  2⤵
                                                    PID:492
                                                • /usr/bin/kill
                                                  kill -9 488 490
                                                  1⤵
                                                    PID:493
                                                  • /bin/kill
                                                    kill -9 488 490
                                                    1⤵
                                                      PID:493
                                                    • /bin/sh
                                                      sh -c "cp /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f /var/root/Library/Preferences/CorelDRAW/CorelDRAW"
                                                      1⤵
                                                        PID:494
                                                      • /bin/bash
                                                        sh -c "cp /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f /var/root/Library/Preferences/CorelDRAW/CorelDRAW"
                                                        1⤵
                                                          PID:494
                                                        • /bin/cp
                                                          cp /Users/run/2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f /var/root/Library/Preferences/CorelDRAW/CorelDRAW
                                                          1⤵
                                                            PID:494
                                                          • /bin/sh
                                                            sh -c "launchctl unload -w /Library/LaunchDaemons/com.CorelDRAW.va.plist"
                                                            1⤵
                                                              PID:495
                                                            • /bin/bash
                                                              sh -c "launchctl unload -w /Library/LaunchDaemons/com.CorelDRAW.va.plist"
                                                              1⤵
                                                                PID:495
                                                              • /bin/launchctl
                                                                launchctl unload -w /Library/LaunchDaemons/com.CorelDRAW.va.plist
                                                                1⤵
                                                                  PID:495
                                                                • /bin/sh
                                                                  sh -c "launchctl load -w /Library/LaunchDaemons/com.CorelDRAW.va.plist"
                                                                  1⤵
                                                                    PID:496
                                                                  • /bin/bash
                                                                    sh -c "launchctl load -w /Library/LaunchDaemons/com.CorelDRAW.va.plist"
                                                                    1⤵
                                                                      PID:496
                                                                    • /bin/launchctl
                                                                      launchctl load -w /Library/LaunchDaemons/com.CorelDRAW.va.plist
                                                                      1⤵
                                                                        PID:496
                                                                      • /usr/libexec/xpcproxy
                                                                        xpcproxy com.CorelDRAW.va.plist
                                                                        1⤵
                                                                          PID:497
                                                                        • /var/root/Library/Preferences/CorelDRAW/CorelDRAW
                                                                          /var/root/Library/Preferences/CorelDRAW/CorelDRAW
                                                                          1⤵
                                                                            PID:497
                                                                          • /usr/bin/pluginkit
                                                                            /usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
                                                                            1⤵
                                                                              PID:521
                                                                            • /usr/sbin/spctl
                                                                              /usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterB516C108/OneDrive.app
                                                                              1⤵
                                                                                PID:522
                                                                              • /usr/sbin/spctl
                                                                                /usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
                                                                                1⤵
                                                                                  PID:538
                                                                                • /usr/libexec/xpcproxy
                                                                                  xpcproxy com.apple.pbs
                                                                                  1⤵
                                                                                    PID:543
                                                                                  • /System/Library/CoreServices/pbs
                                                                                    /System/Library/CoreServices/pbs
                                                                                    1⤵
                                                                                      PID:543
                                                                                    • /bin/launchctl
                                                                                      /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                                                                                      1⤵
                                                                                        PID:546
                                                                                      • /bin/launchctl
                                                                                        /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                                                                                        1⤵
                                                                                          PID:547

                                                                                        Network

                                                                                        MITRE ATT&CK Enterprise v15

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        • /var/root/Library/Preferences/CorelDRAW/CorelDRAW
                                                                                          Filesize

                                                                                          713KB

                                                                                          MD5

                                                                                          23699799f496b8e872d05f19d2b397f8

                                                                                          SHA1

                                                                                          fe3a3e65b86d2b07654f9a6104c8cb392c88b7e8

                                                                                          SHA256

                                                                                          2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f

                                                                                          SHA512

                                                                                          f347c47afe06ed7ef2a71b7e40ac0103f4f33e26250661173775b349bba7452ea458e5d4137a57b34801556959bca14093a9f693d59c147061f63f2b78614288

                                                                                          Download Submit