Overview

overview

4

Static

static

3

setup.exe

macos-10.15-amd64

4

$PLUGINSDI...er.dll

macos-10.15-amd64

1

$PLUGINSDI...LL.dll

macos-10.15-amd64

4

$PLUGINSDI...LL.dll

macos-10.15-amd64

4

$PLUGINSDI...LS.dll

macos-10.15-amd64

1

$PLUGINSDI...64.exe

macos-10.15-amd64

$PLUGINSDI...64.exe

macos-10.15-amd64

1

$PLUGINSDI...64.sys

macos-10.15-amd64

4

$PLUGINSDI...64.exe

macos-10.15-amd64

4

$PLUGINSDI...64.exe

macos-10.15-amd64

4

$PLUGINSDI...2k.sys

macos-10.15-amd64

1

$PLUGINSDI...xp.sys

macos-10.15-amd64

1

$PLUGINSDI...2k.sys

macos-10.15-amd64

1

$PLUGINSDI...px.dll

macos-10.15-amd64

4

$PLUGINSDI...fs.dll

macos-10.15-amd64

4

$PLUGINSDI...rv.dll

macos-10.15-amd64

4

$PLUGINSDI...20.sys

macos-10.15-amd64

1

$PLUGINSDI...er.sys

macos-10.15-amd64

1

$PLUGINSDI...st.exe

macos-10.15-amd64

1

$PLUGINSDI...as.dll

macos-10.15-amd64

4

$PLUGINSDI...up.exe

macos-10.15-amd64

1

$PLUGINSDI...fs.dll

macos-10.15-amd64

4

$PLUGINSDI...ve.dll

macos-10.15-amd64

1

Plugins/Re...is.dll

macos-10.15-amd64

4

Plugins/dsp_sps.dll

macos-10.15-amd64

1

Plugins/en...ac.dll

macos-10.15-amd64

4

Plugins/enc_flac.dll

macos-10.15-amd64

1

Plugins/enc_lame.dll

macos-10.15-amd64

1

Plugins/en...is.dll

macos-10.15-amd64

Plugins/enc_wav.dll

macos-10.15-amd64

1

Plugins/enc_wma.dll

macos-10.15-amd64

4

Plugins/fr...pe.dll

macos-10.15-amd64

4

Analysis

  • max time kernel
    82s
  • max time network
    154s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240611-en
  • resource tags

    arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    04-07-2024 14:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $PLUGINSDIR/PrimoRedist/pxdrv.dll

  • Size

    558KB

  • MD5

    8f6f3aa814143099b431744b16845664

  • SHA1

    67f518591a1cbb954a031cc7421faa1aeb25651a

  • SHA256

    7c9449c2e774087305a28117e47fa48bbf33638144e9694f20d20fb15065ac9f

  • SHA512

    5fdd908862dcabc37a794d0f7fe134e6df9f34d0e52cc69a535c37872a4f2edb44e2448654b3832a11f41fd57be36f1ad0f863603d1f268f99c6180a3a48bcb5

  • SSDEEP

    1536:PdT7plr0Xh+r3xZMmourvvsjI9vW/dy1HW6Hfuj+aUfQe95QV88YfOr1oE0mIQ:PkQMmouQjI9v8NMi7UfQe95FOF

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 1 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/\$PLUGINSDIR/PrimoRedist/pxdrv.dll\""
    1⤵
      PID:575
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/\$PLUGINSDIR/PrimoRedist/pxdrv.dll\""
      1⤵
        PID:575
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run//PrimoRedist/pxdrv.dll
        1⤵
          PID:575
          • /bin/zsh
            /bin/zsh -c /Users/run//PrimoRedist/pxdrv.dll
            2⤵
              PID:576
            • /Users/run//PrimoRedist/pxdrv.dll
              /Users/run//PrimoRedist/pxdrv.dll
              2⤵
                PID:576
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.sysmond
              1⤵
                PID:578
              • /usr/libexec/sysmond
                /usr/libexec/sysmond
                1⤵
                  PID:578
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.security.cloudkeychainproxy3
                  1⤵
                    PID:589
                  • /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
                    /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
                    1⤵
                      PID:589
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.geod
                      1⤵
                        PID:628
                      • /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
                        /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
                        1⤵
                          PID:628
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.AddressBook.ContactsAccountsService
                          1⤵
                            PID:636
                          • /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
                            /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
                            1⤵
                              PID:636
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.suggestd
                              1⤵
                                PID:637
                              • /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
                                /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
                                1⤵
                                  PID:637
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.knowledge-agent
                                  1⤵
                                    PID:638
                                  • /usr/libexec/knowledge-agent
                                    /usr/libexec/knowledge-agent
                                    1⤵
                                      PID:638
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
                                      1⤵
                                        PID:640
                                      • /usr/libexec/neagent
                                        /usr/libexec/neagent
                                        1⤵
                                          PID:640
                                        • /usr/libexec/xpcproxy
                                          xpcproxy com.apple.routined
                                          1⤵
                                            PID:642
                                          • /usr/libexec/routined
                                            /usr/libexec/routined LAUNCHED_BY_LAUNCHD
                                            1⤵
                                              PID:642
                                            • /usr/libexec/xpcproxy
                                              xpcproxy com.apple.Maps.mapspushd
                                              1⤵
                                                PID:645
                                              • /System/Library/CoreServices/mapspushd
                                                /System/Library/CoreServices/mapspushd
                                                1⤵
                                                  PID:645
                                                • /usr/libexec/xpcproxy
                                                  xpcproxy com.apple.siri.context.service
                                                  1⤵
                                                    PID:646
                                                  • /System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
                                                    /System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
                                                    1⤵
                                                      PID:646
                                                    • /usr/bin/pluginkit
                                                      /usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
                                                      1⤵
                                                        PID:647
                                                      • /usr/sbin/spctl
                                                        /usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater2E18A62F/OneDrive.app
                                                        1⤵
                                                          PID:648

                                                        Network

                                                        MITRE ATT&CK Matrix ATT&CK v13

                                                        Initial Access

                                                        Execution

                                                        Persistence

                                                        Privilege Escalation

                                                        Defense Evasion

                                                        Hide Artifacts

                                                        1
                                                        T1564

                                                        Resource Forking

                                                        1
                                                        T1564.009

                                                        Credential Access

                                                        Discovery

                                                        Lateral Movement

                                                        Collection

                                                        Exfiltration

                                                        Command and Control

                                                        Impact

                                                        Resource Development

                                                        Reconnaissance

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
                                                          Filesize

                                                          124KB

                                                          MD5

                                                          34d31a5323bef8f8f2b9723580b1c012

                                                          SHA1

                                                          373df49a91ab2d8163d503b8c32296d12e336666

                                                          SHA256

                                                          1621be2c4636d56ef7bb65e56eb63fd655aacc0927fc708876f1d313f2f64980

                                                          SHA512

                                                          6fe0ee547647f0926cc50d295b9b1a9639ea93999a3d55c4e2f785082b039c26993550aab11fef70bde99076a6c6461a143520ac975d05a204211c88dff686c4

                                                          Download Submit