Overview
overview
3Static
static
3XMouseButt....5.exe
macos-10.15-amd64
1$PLUGINSDI...md.dll
macos-10.15-amd64
1$PLUGINSDI...ns.dll
macos-10.15-amd64
1$PLUGINSDI...er.dll
macos-10.15-amd64
1$PLUGINSDI...em.dll
macos-10.15-amd64
1$PLUGINSDI...gs.dll
macos-10.15-amd64
1BugTrapU-x64.dll
macos-10.15-amd64
1XMouseButt...ol.exe
macos-10.15-amd64
1XMouseButtonHook.dll
macos-10.15-amd64
1uninstaller.exe
macos-10.15-amd64
1$PLUGINSDI...md.dll
macos-10.15-amd64
1$PLUGINSDI...em.dll
macos-10.15-amd64
1Analysis
-
max time kernel
146s -
max time network
155s -
platform
macos-10.15_amd64 -
resource
macos-20240711.1-en -
resource tags
arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
26-08-2024 18:58
Static task
static1
Behavioral task
behavioral1
Sample
XMouseButtonControlSetup.2.20.5.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ShellExecAsUser.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral7
Sample
BugTrapU-x64.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral8
Sample
XMouseButtonControl.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral9
Sample
XMouseButtonHook.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral10
Sample
uninstaller.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
macos-20240711.1-en
General
-
Target
XMouseButtonControlSetup.2.20.5.exe
-
Size
2.9MB
-
MD5
2e9725bc1d71ad1b8006dfc5a2510f88
-
SHA1
6e1f7d12881696944bf5e030a7d131b969de0c6c
-
SHA256
2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818
-
SHA512
62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39
-
SSDEEP
49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/XMouseButtonControlSetup.2.20.5.exe\""1⤵PID:483
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/XMouseButtonControlSetup.2.20.5.exe\""1⤵PID:483
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/XMouseButtonControlSetup.2.20.5.exe1⤵PID:483
-
/bin/zsh/bin/zsh -c /Users/run/XMouseButtonControlSetup.2.20.5.exe2⤵PID:485
-
-
/Users/run/XMouseButtonControlSetup.2.20.5.exe/Users/run/XMouseButtonControlSetup.2.20.5.exe2⤵PID:485
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.AddressBook.17801⤵PID:511
-
/System/Applications/Contacts.app/Contents/MacOS/Contacts/System/Applications/Contacts.app/Contents/MacOS/Contacts1⤵PID:511
-
/usr/libexec/xpcproxyxpcproxy com.apple.contacts.donation-agent1⤵PID:512
-
/System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent/System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent1⤵PID:512
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵PID:523
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵PID:524
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵PID:540
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵PID:540
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
278B
MD5ceb12b166b68312c41af8bcfe2c01570
SHA10eb463f486b4a3b2116135006c13b0823b189c37
SHA256323ee2778aab52148273ec7ffa46018ea3f8fd1dc408fd7532cc2a5220ba1894
SHA51249bca53444dcbdae2d1e666abbefc990b98feba7991c9e5a80c0cb2f42d69df7e146632e105658340d6869a3e7307432e897547434ac351ce50e72c2b5a5fd24