a1f38cb9f8c856754accd0c2ae2ff3ae10492a73926a9d6f13be3219413818be

General

Target
ScreenMemory/ScreenMemory.app/Contents/MacOS/ScreenMemory
Size 706KB
Sample260928-19rayswsds
SHA256 a1f38cb9f8c856754accd0c2ae2ff3ae10492a73926a9d6f13be3219413818be
MD5 6e15ab27060c9e77ec252bcf3d8eeb8c
SHA1 a737c7c78b42a1879bd02c2fb19fbdea37af8fcd
SHA512 0126b7086ca43c676730eb29daa54d1695fc95817d42d287c0d74d98fefc568effaa0b60e2899fb9b5d0734ab74ceead2a504814298e5b86ba905553ceb079a3
SSDEEP 12288:tU7wAcpxXAIIETE1UWLwJrr1nuwyUPUcyvmByHaRR1L+:tU7RyAOTtevPaRW
TLSH
T1FEF42AAB527AA4D4EC4732747B8A3BF7EE40B47663F5E4A9AA42513448F3374913021F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution

Malware Config

Signatures

Identifies hardware specifics through system_profiler 2 IoCs

ioc	Process
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"	Process not Found
system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType	Process not Found

Prompts the user for their password using a hidden input dialog 1 TTPs 2 IoCs

Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.

credential_access collection

GUI Input Capture

T1056.002

ioc	Process
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"	Process not Found
osascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"	Process not Found

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"	Process not Found
osascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"	Process not Found

Checks the status of system security protections 1 TTPs 1 IoCs

System utilities were executed to query the status of System Integrity Protection or FileVault encryption. This can be abused to discover local security settings.

discovery

Security Software Discovery

T1518.001

ioc	Process
/usr/bin/csrutil status	Process not Found

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/ScreenMemory/ScreenMemory.app/Contents/MacOS/ScreenMemory\""
1⤵
PID:461

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/ScreenMemory/ScreenMemory.app/Contents/MacOS/ScreenMemory\""
1⤵
PID:461

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/ScreenMemory/ScreenMemory.app/Contents/MacOS/ScreenMemory
1⤵
PID:461
- /bin/zsh
  /bin/zsh -c /Users/run/ScreenMemory/ScreenMemory.app/Contents/MacOS/ScreenMemory
  2⤵
  PID:464
- /Users/run/ScreenMemory/ScreenMemory.app/Contents/MacOS/ScreenMemory
  /Users/run/ScreenMemory/ScreenMemory.app/Contents/MacOS/ScreenMemory
  2⤵
  PID:464

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:449

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:456

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:447

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:452

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:457

/bin/sh
sh -c "killall Terminal 2>/dev/null"
1⤵
PID:466

/bin/bash
sh -c "killall Terminal 2>/dev/null"
1⤵
PID:466
- /usr/bin/killall
  killall Terminal
  2⤵
  PID:467

/bin/sh
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"
1⤵
PID:468

/bin/bash
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"
1⤵
PID:468
- /usr/sbin/system_profiler
  system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
  2⤵
  PID:469

/usr/bin/csrutil
/usr/bin/csrutil status
1⤵
PID:472

/bin/sh
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"
1⤵
PID:487

/bin/bash
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"
1⤵
PID:487
- /usr/bin/osascript
  osascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"
  2⤵
  PID:488