Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

DiskMaker_X_9.dmg

bzip2 compressed data, block size = 100k

initial sample

Details

Filetype:	bzip2 compressed data, block size = 100k
Entropy:	7.999667829376183
Filename:	DiskMaker_X_9.dmg
Filesize:	6272758
MD5:	d575c6a40278340f092a6fc4e26e4d11
SHA1:	87d92610155135621014afefa88d8b6c9ad5f0ed
SHA256:	96845cd375543401b822fb4e17d2ecc300fcb621f56afcdad613ae11c9afddce
SHA512:	f18cf8eee40b9c1cfe1a2141ffd6e59e36f34fb7908ffb5383847b45bc0b5571efd4c80c2969409744274c744e6124dd3d2a62d408501d71ceb8bab7f4585d3f
SSDEEP:	98304:SqTiPyIC9pzheDyGVPAJBajoIz82jt58wb9TmzV4C1V5zw7NSmj5TGdjFOIZRZ/d:fTiaPpAVPAJwA68wb9adjwgiFG5F7PZq
Preview:	BZh11AY&SY...[...G........@.. .1....%......H.......`BZh11AY&SY"4e........P.@....BH..... .@... .u..2....i.6..P....Tq.w.&...8...:.H.... .F#.X.Ou.......-...:..@.?...cN&..K@.I/...N.$...~@BZh91AY&SYTtL...e......................................R(+..=.......yuA.

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

/Users/berri/Library/Logs/DiskMakerX.log

ASCII text

dropped

Details

File:	/Users/berri/Library/Logs/DiskMakerX.log
Category:	dropped
Dump:	DiskMakerX.log.347.dr
ID:	dr_8
Target ID:	347
Process:	/bin/sh
Type:	ASCII text
Entropy:	3.6464393446710153
Encrypted:	false
Ssdeep:	3:OXzXWvn:IzXo
Size:	20
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Executes the "touch" command used to create files or modify time stamps	Persistence and Installation Behavior	Indicator Removal on Host
Many shell processes execute programs via execve syscall (might be indicative for malicious behavior)	Persistence and Installation Behavior
Writes log files to disk	Persistence and Installation Behavior

/dev/null

ASCII text

dropped

Details

File:	/dev/null
Category:	dropped
Dump:	null.288.dr
ID:	dr_0
Target ID:	288
Process:	/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet
Type:	ASCII text
Entropy:	4.699271510042169
Encrypted:	false
Ssdeep:	3:tXjtFD9VjAYeWw/3WOv:Rtt38YeIA
Size:	61
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32

n/a

/usr/bin/open

/usr/libexec/xpcproxy

n/a

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c echo $HOME

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c touch '/Users/berri'/Library/Logs/DiskMakerX.log

/usr/bin/touch

touch /Users/berri/Library/Logs/DiskMakerX.log

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c echo '--------------------------------------------------------------------------------' >> '/Users/berri'/Library/Logs/DiskMakerX.log

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c date >> '/Users/berri'/Library/Logs/DiskMakerX.log

/bin/sh

n/a

/bin/date

date

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c echo 'Home Path: ' '/Users/berri'>> '/Users/berri'/Library/Logs/DiskMakerX.log

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c defaults read NSGlobalDomain AppleLanguages

/usr/bin/defaults

defaults read NSGlobalDomain AppleLanguages

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c echo 'Current Language: ' en-CH>> '/Users/berri'/Library/Logs/DiskMakerX.log

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c sw_vers -productVersion | cut -c 1-4

/bin/sh

n/a

/usr/bin/sw_vers

sw_vers -productVersion

/bin/sh

n/a

/usr/bin/cut

cut -c 1-4

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c sw_vers -productVersion | cut -c 4-4

/bin/sh

n/a

/usr/bin/sw_vers

sw_vers -productVersion

/bin/sh

n/a

/usr/bin/cut

cut -c 4-4

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c sw_vers -productVersion | cut -c 1-5

/bin/sh

n/a

/usr/bin/sw_vers

sw_vers -productVersion

/bin/sh

n/a

/usr/bin/cut

cut -c 1-5

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c sw_vers -productVersion | cut -c 4-5

/bin/sh

n/a

/usr/bin/sw_vers

sw_vers -productVersion

/bin/sh

n/a

/usr/bin/cut

cut -c 4-5

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c echo 'Current OS: ' 10.13>> '/Users/berri'/Library/Logs/DiskMakerX.log

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c id -G

/usr/bin/id

id -G

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c echo 'Is this user an admin : ' true>> '/Users/berri'/Library/Logs/DiskMakerX.log

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c ps auxc

/bin/ps

ps auxc

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c echo 'Path Finder launched : ' false>> '/Users/berri'/Library/Logs/DiskMakerX.log

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c curl http://diskmakerx.com/CurrentLDMVersion

/usr/bin/curl

curl http://diskmakerx.com/CurrentLDMVersion

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c echo 'Selected OS: ' 10.15>> '/Users/berri'/Library/Logs/DiskMakerX.log

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c mdfind -name 'Install macOS Catalina' | grep -v Library | head -1

/bin/sh

n/a

/usr/bin/mdfind

mdfind -name Install macOS Catalina

/bin/sh

n/a

/usr/bin/grep

grep -v Library

/bin/sh

n/a

/usr/bin/head

head -1

/Volumes/DiskMaker X 9/DiskMaker X 9 for macOS Catalina.app/Contents/MacOS/applet

n/a

/bin/sh

sh -c echo '' | wc -l

/bin/sh

n/a

/bin/sh

n/a

/usr/bin/wc

wc -l

/usr/libexec/automountd

n/a

/usr/libexec/od_user_homes

/usr/libexec/od_user_homes .localized

There are 68 hidden processes, click here to show them.

URLs

Name

Malicious

http://diskmakerx.com/CurrentLDMVersion

217.160.0.214

Details

Name:	http://diskmakerx.com/CurrentLDMVersion
IP:	217.160.0.214
TargetID:	-1
From Memory:	false
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Executes commands using a shell command-line interpreter	Persistence and Installation Behavior	Scripting
Executes the "curl" command used to transfer data via the network (typically using HTTP/S)	Persistence and Installation Behavior	Exfiltration Over Alternative Protocol
Many shell processes execute programs via execve syscall (might be indicative for malicious behavior)	Persistence and Installation Behavior

Domains

Name

Malicious

diskmakerx.com

217.160.0.214

Details

Name:	diskmakerx.com
IP:	217.160.0.214
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Executes commands using a shell command-line interpreter	Persistence and Installation Behavior	Scripting
Executes the "curl" command used to transfer data via the network (typically using HTTP/S)	Persistence and Installation Behavior	Exfiltration Over Alternative Protocol
Many shell processes execute programs via execve syscall (might be indicative for malicious behavior)	Persistence and Installation Behavior
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

217.160.0.214

diskmakerx.com

Germany

23.3.109.8

unknown

United States

Details

IP:	23.3.109.8
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	16625
ASN name:	AKAMAI-ASUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
DiskMaker_X_9.dmg

Files

Processes

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportDiskMaker_X_9.dmg

Files

Processes

URLs

Domains

IPs

IOC Report
DiskMaker_X_9.dmg