Analysis
-
max time kernel
148s -
max time network
149s -
platform
macos-10.15_amd64 -
resource
macos-20240711.1-en -
resource tags
arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
06-09-2024 06:29
Behavioral task
behavioral1
Sample
20240906b9d9c640ae8635c41645f69d838daccfadloadevilquestrekoobe
Resource
macos-20240711.1-en
General
-
Target
20240906b9d9c640ae8635c41645f69d838daccfadloadevilquestrekoobe
-
Size
168KB
-
MD5
b9d9c640ae8635c41645f69d838daccf
-
SHA1
bdc6fe45198c9de57278a40e95116deb3438a024
-
SHA256
eaff00bb9a60ca15c4ffcce8139badc707c6ee2a67aefad584fdeb0ae32291eb
-
SHA512
4ed8dd17f8ff94ff7cb67e2dc8818cc7840f252e094a2863dd0b8500868147d2fc600d3d9c97c8e1f43b9195c5ce47c5039b8f980b0e9e8c821160f733be354f
-
SSDEEP
3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9W0:5SeOQdaZNxtk8cqhSxvHY9
Malware Config
Signatures
-
Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
-
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
-
AppleScript 1 TTPs 8 IoCs
AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.
ioc Process osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found -
Launchctl 1 TTPs 16 IoCs
Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.
ioc Process sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found /bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist" Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist" Process not Found launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist Process not Found osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found /bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist" Process not Found launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" Process not Found
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/20240906b9d9c640ae8635c41645f69d838daccfadloadevilquestrekoobe\""1⤵PID:482
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/20240906b9d9c640ae8635c41645f69d838daccfadloadevilquestrekoobe\""1⤵PID:482
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/20240906b9d9c640ae8635c41645f69d838daccfadloadevilquestrekoobe1⤵PID:482
-
/bin/zsh/bin/zsh -c /Users/run/20240906b9d9c640ae8635c41645f69d838daccfadloadevilquestrekoobe2⤵PID:483
-
-
/Users/run/20240906b9d9c640ae8635c41645f69d838daccfadloadevilquestrekoobe/Users/run/20240906b9d9c640ae8635c41645f69d838daccfadloadevilquestrekoobe2⤵PID:483
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:485
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:485
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:485
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:511
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:511
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:511
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.authtrampoline1⤵PID:512
-
/System/Library/Frameworks/Security.framework/authtrampoline/System/Library/Frameworks/Security.framework/authtrampoline1⤵PID:512
-
/bin/sh/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:513
-
/bin/bash/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:513
-
/bin/launchctllaunchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:513
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:514
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:514
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:515
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:515
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:515
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:516
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:516
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:516
-
/bin/sh/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:517
-
/bin/bash/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:517
-
/bin/launchctllaunchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:517
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:518
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:518
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:518
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:519
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:519
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:519
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:520
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:520
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:520
-
/bin/sh/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:521
-
/bin/bash/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:521
-
/bin/launchctllaunchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:521
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:527
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:527
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:528
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:528
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:528
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵PID:529
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵PID:530
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵PID:534
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵PID:534
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:536
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:536
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:537
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:537
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:537
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:538
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:538
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:539
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:539
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:539
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:543
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:543
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:544
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:544
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:544
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:547
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:547
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:548
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:548
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:548
-
/usr/libexec/xpcproxyxpcproxy com.apple.newsyslog1⤵PID:558
-
/usr/sbin/newsyslog/usr/sbin/newsyslog1⤵PID:558
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:561
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:561
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:562
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:562
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:562
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:563
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:563
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:564
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:564
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:564
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:567
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:567
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:568
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:568
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:568
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:569
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:569
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:570
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:570
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:570
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:571
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:571
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:572
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:572
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:572
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:573
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:573
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:574
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:574
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:574
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:575
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:575
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:576
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:576
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:576
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:577
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:577
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:578
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:578
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:578
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:579
-
/Users/run/Library/osxmobiledata/com.apple.afsvcpd/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:579
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:580
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:580
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:580