Overview

overview

4

Static

static

3

dolphin-x64-5.0.exe

android-13-x64

dolphin-x64-5.0.exe

macos-10.15-amd64

1

$PLUGINSDI...ns.dll

android-13-x64

$PLUGINSDI...ns.dll

macos-10.15-amd64

1

$PLUGINSDI...LL.dll

android-13-x64

$PLUGINSDI...LL.dll

macos-10.15-amd64

1

$PLUGINSDI...em.dll

android-13-x64

$PLUGINSDI...em.dll

macos-10.15-amd64

1

infinst.exe

android-13-x64

infinst.exe

macos-10.15-amd64

4

xinput1_3.dll

android-13-x64

xinput1_3.dll

macos-10.15-amd64

1

xinput1_3.dll

android-13-x64

xinput1_3.dll

macos-10.15-amd64

1

$TEMP/dxre...UP.dll

android-13-x64

$TEMP/dxre...UP.dll

macos-10.15-amd64

1

$TEMP/dxre...UP.exe

android-13-x64

$TEMP/dxre...UP.exe

macos-10.15-amd64

1

$TEMP/dxre...32.dll

android-13-x64

$TEMP/dxre...32.dll

macos-10.15-amd64

1

dxupdate.dll

android-13-x64

dxupdate.dll

macos-10.15-amd64

4

$TEMP/vcre...64.exe

android-13-x64

$TEMP/vcre...64.exe

macos-10.15-amd64

1

Dolphin.exe

android-13-x64

Dolphin.exe

macos-10.15-amd64

1

OpenAL32.dll

android-13-x64

OpenAL32.dll

macos-10.15-amd64

1

Sys/GameSe...r2.ps1

android-13-x64

Sys/GameSe...r2.ps1

macos-10.15-amd64

1

Sys/GameSe...01.ps1

android-13-x64

Sys/GameSe...01.ps1

macos-10.15-amd64

1

Analysis

  • max time kernel
    126s
  • max time network
    148s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    05-08-2024 22:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    infinst.exe

  • Size

    68KB

  • MD5

    45d4dac07aa361bcd77aa815d1724a16

  • SHA1

    3bbdf7da5d51211ae269572961b5ebf508ada28d

  • SHA256

    34ab99536ea59ad60ba6efda3ea6d18291ef096a0bab3664248d6045805da0ec

  • SHA512

    d940002a8e0112a3b56a909008403b447e9cbb80e38b9bbd508f40aa68224f7e5d9681e1039e747ae939e0829a25be2319b9f9d0862cebb042e4c525ccbc20be

  • SSDEEP

    1536:dSKL6bzRYK/ixmu3XyhJRxjWhKfLXJ/y/Fae:dSKL62K/u3XmxCAfLXJ/y/E

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 1 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/infinst.exe\""
    1⤵
      PID:489
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/infinst.exe\""
      1⤵
        PID:489
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/infinst.exe
        1⤵
          PID:489
          • /bin/zsh
            /bin/zsh -c /Users/run/infinst.exe
            2⤵
              PID:490
            • /Users/run/infinst.exe
              /Users/run/infinst.exe
              2⤵
                PID:490
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.iChat.1880
              1⤵
                PID:523
              • /System/Applications/Messages.app/Contents/MacOS/Messages
                /System/Applications/Messages.app/Contents/MacOS/Messages
                1⤵
                  PID:523
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.audio.toolbox.reporting.service
                  1⤵
                    PID:525
                  • /System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService
                    /System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService
                    1⤵
                      PID:525
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 523
                      1⤵
                        PID:528
                      • /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
                        /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
                        1⤵
                          PID:528
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.PerformanceAnalysis.animationperfd
                          1⤵
                            PID:529
                          • /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                            /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                            1⤵
                              PID:529
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                              1⤵
                                PID:532
                              • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                1⤵
                                  PID:532
                                • /bin/launchctl
                                  /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                                  1⤵
                                    PID:535
                                  • /bin/launchctl
                                    /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                                    1⤵
                                      PID:536
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.spindump
                                      1⤵
                                        PID:538
                                      • /usr/sbin/spindump
                                        /usr/sbin/spindump
                                        1⤵
                                          PID:538
                                        • /usr/libexec/xpcproxy
                                          xpcproxy com.apple.spindump_agent
                                          1⤵
                                            PID:539
                                          • /usr/libexec/spindump_agent
                                            /usr/libexec/spindump_agent
                                            1⤵
                                              PID:539
                                            • /usr/libexec/xpcproxy
                                              xpcproxy com.apple.AppStore.1900
                                              1⤵
                                                PID:540
                                              • /System/Applications/App Store.app/Contents/MacOS/App Store
                                                "/System/Applications/App Store.app/Contents/MacOS/App Store"
                                                1⤵
                                                  PID:540
                                                • /usr/libexec/xpcproxy
                                                  xpcproxy com.apple.storeuid
                                                  1⤵
                                                    PID:542
                                                  • /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
                                                    /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
                                                    1⤵
                                                      PID:542
                                                    • /usr/libexec/xpcproxy
                                                      xpcproxy com.apple.coremedia.videodecoder 540
                                                      1⤵
                                                        PID:544
                                                      • /System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
                                                        /System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
                                                        1⤵
                                                          PID:544
                                                        • /usr/libexec/xpcproxy
                                                          xpcproxy com.apple.accessibility.mediaaccessibilityd
                                                          1⤵
                                                            PID:547
                                                          • /System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
                                                            /System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
                                                            1⤵
                                                              PID:547
                                                            • /usr/libexec/xpcproxy
                                                              xpcproxy com.apple.ReportMemoryException
                                                              1⤵
                                                                PID:548
                                                              • /usr/libexec/ReportMemoryException
                                                                /usr/libexec/ReportMemoryException
                                                                1⤵
                                                                  PID:548
                                                                • /usr/libexec/xpcproxy
                                                                  xpcproxy com.apple.Terminal.2100
                                                                  1⤵
                                                                    PID:549
                                                                  • /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
                                                                    /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
                                                                    1⤵
                                                                      PID:549
                                                                      • /usr/bin/login
                                                                        login -pf run
                                                                        2⤵
                                                                          PID:550
                                                                          • /bin/zsh
                                                                            -zsh
                                                                            3⤵
                                                                              PID:551
                                                                              • /usr/libexec/path_helper
                                                                                /usr/libexec/path_helper -s
                                                                                4⤵
                                                                                  PID:552
                                                                                • /usr/bin/locale
                                                                                  locale LC_CTYPE
                                                                                  4⤵
                                                                                    PID:553

                                                                            Network

                                                                            MITRE ATT&CK Enterprise v15

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.iChat//mds/mdsDirectory.db
                                                                              Filesize

                                                                              47KB

                                                                              MD5

                                                                              0e4a0d1ceb2af6f0f8d0167ce77be2d3

                                                                              SHA1

                                                                              414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

                                                                              SHA256

                                                                              cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

                                                                              SHA512

                                                                              1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

                                                                              Download Submit

                                                                            • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.iChat//mds/mdsObject.db
                                                                              Filesize

                                                                              4KB

                                                                              MD5

                                                                              d3a1859e6ec593505cc882e6def48fc8

                                                                              SHA1

                                                                              f8e6728e3e9de477a75706faa95cead9ce13cb32

                                                                              SHA256

                                                                              3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

                                                                              SHA512

                                                                              ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

                                                                              Download Submit