Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Download

/Users/berri/Library/Safari/.dat.nosync0226.qLaaaV

Apple binary property list

dropped

/Users/berri/Library/Safari/.dat.nosync0226.rNbQVU

XML 1.0 document, ASCII text

dropped

/Users/berri/Library/WebKit/com.apple.Safari/WebsiteData/ResourceLoadStatistics/full_browsing_session_resourceLog.plist

Apple binary property list

dropped

/dev/null

ASCII text

dropped

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/0/SafariFamily/Safari/.dat.nosync0226.MzqjWS

Apple binary property list

dropped

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/C/mds/mdsDirectory.db_

Mac OS X Keychain File

dropped

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/C/mds/mdsObject.db_

Mac OS X Keychain File

dropped

/private/var/log/wifi.log.0.bz2

bzip2 compressed data, block size = 900k

dropped

/private/var/tmp/NSCreateObjectFileImageFromMemory-8Ux4de

Mach-O 64-bit x86_64 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>

dropped

/private/var/tmp/NSCreateObjectFileImageFromMemory-I5RRkf

Mach-O 64-bit x86_64 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>

dropped

/private/var/tmp/NSCreateObjectFileImageFromMemory-WLJA5P

Mach-O 64-bit x86_64 bundle, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL>

dropped

There are 2 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

/usr/libexec/xpcproxy

n/a

Details

PID:	550
Target ID:	233
Parent PID:	1
Name:	xpcproxy
Path:	/usr/libexec/xpcproxy
Commandline:	n/a
Size:	43488
MD5:	d1bb9a4899f0af921e8188218b20d744
Time:	22:36:30
Date:	05/10/2021

/Applications/Safari.app/Contents/MacOS/Safari

Details

PID:	550
Target ID:	234
Parent PID:	1
Name:	Safari
Path:	/Applications/Safari.app/Contents/MacOS/Safari
Commandline:	/Applications/Safari.app/Contents/MacOS/Safari
Size:	20896
MD5:	8e18be737fe87f19fe7a97b4821e2005
Time:	22:36:30
Date:	05/10/2021

/usr/bin/bzip2

n/a

Details

PID:	559
Target ID:	251
Parent PID:	515
Name:	bzip2
Path:	/usr/bin/bzip2
Commandline:	n/a
Size:	41312
MD5:	990a9f96a9d194798749594c1974dde8
Time:	22:36:40
Date:	05/10/2021

URLs

Name

Malicious

https://xyt2i.mjt.lu/lnk/AUsAADzeJ50AAAAIleYAABKYp8QAAAAAd7gAAMIAABga0gBhXLPWvOUjiH6uQUiZaqJkemuK6QAW_mw/1/gS9BhkQtcGsgqjFuAFhUGQ/aHR0cHM6Ly9vdXRib3gtbWVzc2FnZXMudXBkYXRlcmVkaXJlY3Rpbmdsb2dpbi53b3JrZXJzLmRldi8jbGhlbmRyaXhAdHJ1ZWFjY29yZC5jb20#lhendrix@trueaccord.com

Details

Filetype:	URL
Filename:	https://xyt2i.mjt.lu/lnk/AUsAADzeJ50AAAAIleYAABKYp8QAAAAAd7gAAMIAABga0gBhXLPWvOUjiH6uQUiZaqJkemuK6QAW_mw/1/gS9BhkQtcGsgqjFuAFhUGQ/aHR0cHM6Ly9vdXRib3gtbWVzc2FnZXMudXBkYXRlcmVkaXJlY3Rpbmdsb2dpbi53b3JrZXJzLmRldi8jbGhlbmRyaXhAdHJ1ZWFjY29yZC5jb20#lhendrix@trueaccord.com

Signature Hits	Behavior Group	Mitre Attack
Writes 64-bit Mach-O files to disk	Persistence and Installation Behavior
Opens the Safari browser app	Persistence and Installation Behavior
Reads the system or server version plist file	Language, Device and Operating System Detection	System Information Discovery
Reads data from the local random generator	Persistence and Installation Behavior
Performs DNS lookups	Networking	Non-Application Layer Protocol Application Layer Protocol
Uses AppleKeyboardLayouts bundle containing keyboard layouts	Persistence and Installation Behavior
Classification label	System Summary
Writes property list (.plist) files to disk	Persistence and Installation Behavior	Plist Modification
Uses HTTPS	Networking	Encrypted Channel
URLs found in memory or binary data	Networking
Connects to IPs without corresponding DNS lookups	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

https://outbox-messages.updateredirectinglogin.workers.dev/#lhendrix

unknown

Details

Name:	https://outbox-messages.updateredirectinglogin.workers.dev/#lhendrix
TargetID:	234
From Memory:	true
Current Path:	/Applications/Safari.app/Contents/MacOS/Safari
Source:	.dat.nosync0226.qLaaaV.234.dr

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

stackpath.bootstrapcdn.com

104.18.11.207

gateway.fe.apple-dns.net

17.248.145.108

cdn.digicertcdn.com

104.18.10.39

www.google.com

142.250.185.132

outbox-messages.updateredirectinglogin.workers.dev

104.21.51.225

xyt2i.mjt.lu

35.241.186.140

www.trueaccord.com

143.204.98.58

x1.c.lencr.org

unknown

code.jquery.com

unknown

r3.o.lencr.org

unknown

IPs

Domain

Country

Malicious

104.21.51.225

outbox-messages.updateredirectinglogin.workers.dev

United States

Details

IP:	104.21.51.225
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	outbox-messages.updateredirectinglogin.workers.dev

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

142.250.185.132

www.google.com

United States

Details

IP:	142.250.185.132
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	www.google.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

35.241.186.140

xyt2i.mjt.lu

United States

Details

IP:	35.241.186.140
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	xyt2i.mjt.lu

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

104.18.11.207

stackpath.bootstrapcdn.com

United States

Details

IP:	104.18.11.207
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	stackpath.bootstrapcdn.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

104.90.164.244

unknown

United States

Details

IP:	104.90.164.244
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	16625
ASN name:	AKAMAI-ASUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

143.204.98.58

www.trueaccord.com

United States

Details

IP:	143.204.98.58
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	16509
ASN name:	AMAZON-02US
Private:	false
Domain:	www.trueaccord.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

Domains

IPs