Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-01-2025 03:30
Static task
static1
Behavioral task
behavioral1
Sample
resembleC2.exe
Resource
win7-20240903-en
General
-
Target
resembleC2.exe
-
Size
763KB
-
MD5
f70fb0eacdba5672bd67ff9ad29e425b
-
SHA1
35c7ad26473afb12c8b46dfb51f3e0d73b92a7eb
-
SHA256
325ec7369a18af43c95815bacf830f5bcd1093436c25f67685226fe0d4812280
-
SHA512
e93012796de946c4b009d9c68a539ea010d88952c11ddd0fc05d3d4ebe1657f16a7f75269e2c6075c12564f40752c7f4aec0c64583ffb46d06ec69431e5f6ff5
-
SSDEEP
12288:wjB1GbyBRc8nAVCCpViLkSdIi/NvFFuHtHylX5mmYKlzQUG1R9qRst2hmKyL/mVD:wjB1myBRccwf/SdNFvFFu1yh5zlzY1RS
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023c8d-20.dat family_umbral behavioral2/memory/4244-28-0x0000013B932A0000-0x0000013B932E0000-memory.dmp family_umbral -
Umbral family
-
pid Process 3464 powershell.exe 3824 powershell.exe 2172 powershell.exe 3676 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts MoonHub.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation resembleC2.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation resemble.exe -
Executes dropped EXE 3 IoCs
pid Process 4172 resemble.exe 4244 MoonHub.exe 4924 AudioDriver.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini resemble.exe File opened for modification C:\Windows\assembly\Desktop.ini resemble.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 23 discord.com 24 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly resemble.exe File created C:\Windows\assembly\Desktop.ini resemble.exe File opened for modification C:\Windows\assembly\Desktop.ini resemble.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language resemble.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1116 cmd.exe 3384 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2372 wmic.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings resembleC2.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings OpenWith.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3384 PING.EXE -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 4244 MoonHub.exe 3676 powershell.exe 3676 powershell.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 3464 powershell.exe 3464 powershell.exe 3824 powershell.exe 3824 powershell.exe 1184 powershell.exe 1184 powershell.exe 2172 powershell.exe 2172 powershell.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe 4924 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4244 MoonHub.exe Token: SeIncreaseQuotaPrivilege 464 wmic.exe Token: SeSecurityPrivilege 464 wmic.exe Token: SeTakeOwnershipPrivilege 464 wmic.exe Token: SeLoadDriverPrivilege 464 wmic.exe Token: SeSystemProfilePrivilege 464 wmic.exe Token: SeSystemtimePrivilege 464 wmic.exe Token: SeProfSingleProcessPrivilege 464 wmic.exe Token: SeIncBasePriorityPrivilege 464 wmic.exe Token: SeCreatePagefilePrivilege 464 wmic.exe Token: SeBackupPrivilege 464 wmic.exe Token: SeRestorePrivilege 464 wmic.exe Token: SeShutdownPrivilege 464 wmic.exe Token: SeDebugPrivilege 464 wmic.exe Token: SeSystemEnvironmentPrivilege 464 wmic.exe Token: SeRemoteShutdownPrivilege 464 wmic.exe Token: SeUndockPrivilege 464 wmic.exe Token: SeManageVolumePrivilege 464 wmic.exe Token: 33 464 wmic.exe Token: 34 464 wmic.exe Token: 35 464 wmic.exe Token: 36 464 wmic.exe Token: SeIncreaseQuotaPrivilege 464 wmic.exe Token: SeSecurityPrivilege 464 wmic.exe Token: SeTakeOwnershipPrivilege 464 wmic.exe Token: SeLoadDriverPrivilege 464 wmic.exe Token: SeSystemProfilePrivilege 464 wmic.exe Token: SeSystemtimePrivilege 464 wmic.exe Token: SeProfSingleProcessPrivilege 464 wmic.exe Token: SeIncBasePriorityPrivilege 464 wmic.exe Token: SeCreatePagefilePrivilege 464 wmic.exe Token: SeBackupPrivilege 464 wmic.exe Token: SeRestorePrivilege 464 wmic.exe Token: SeShutdownPrivilege 464 wmic.exe Token: SeDebugPrivilege 464 wmic.exe Token: SeSystemEnvironmentPrivilege 464 wmic.exe Token: SeRemoteShutdownPrivilege 464 wmic.exe Token: SeUndockPrivilege 464 wmic.exe Token: SeManageVolumePrivilege 464 wmic.exe Token: 33 464 wmic.exe Token: 34 464 wmic.exe Token: 35 464 wmic.exe Token: 36 464 wmic.exe Token: SeDebugPrivilege 3676 powershell.exe Token: SeDebugPrivilege 4924 AudioDriver.exe Token: SeDebugPrivilege 3464 powershell.exe Token: SeDebugPrivilege 3824 powershell.exe Token: SeDebugPrivilege 1184 powershell.exe Token: SeIncreaseQuotaPrivilege 1388 wmic.exe Token: SeSecurityPrivilege 1388 wmic.exe Token: SeTakeOwnershipPrivilege 1388 wmic.exe Token: SeLoadDriverPrivilege 1388 wmic.exe Token: SeSystemProfilePrivilege 1388 wmic.exe Token: SeSystemtimePrivilege 1388 wmic.exe Token: SeProfSingleProcessPrivilege 1388 wmic.exe Token: SeIncBasePriorityPrivilege 1388 wmic.exe Token: SeCreatePagefilePrivilege 1388 wmic.exe Token: SeBackupPrivilege 1388 wmic.exe Token: SeRestorePrivilege 1388 wmic.exe Token: SeShutdownPrivilege 1388 wmic.exe Token: SeDebugPrivilege 1388 wmic.exe Token: SeSystemEnvironmentPrivilege 1388 wmic.exe Token: SeRemoteShutdownPrivilege 1388 wmic.exe Token: SeUndockPrivilege 1388 wmic.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4924 AudioDriver.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4924 AudioDriver.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3288 OpenWith.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 4308 wrote to memory of 4172 4308 resembleC2.exe 83 PID 4308 wrote to memory of 4172 4308 resembleC2.exe 83 PID 4308 wrote to memory of 4172 4308 resembleC2.exe 83 PID 4308 wrote to memory of 4244 4308 resembleC2.exe 85 PID 4308 wrote to memory of 4244 4308 resembleC2.exe 85 PID 4244 wrote to memory of 464 4244 MoonHub.exe 86 PID 4244 wrote to memory of 464 4244 MoonHub.exe 86 PID 4244 wrote to memory of 2968 4244 MoonHub.exe 89 PID 4244 wrote to memory of 2968 4244 MoonHub.exe 89 PID 4244 wrote to memory of 3676 4244 MoonHub.exe 91 PID 4244 wrote to memory of 3676 4244 MoonHub.exe 91 PID 4172 wrote to memory of 4924 4172 resemble.exe 93 PID 4172 wrote to memory of 4924 4172 resemble.exe 93 PID 4172 wrote to memory of 4924 4172 resemble.exe 93 PID 4244 wrote to memory of 3464 4244 MoonHub.exe 94 PID 4244 wrote to memory of 3464 4244 MoonHub.exe 94 PID 4244 wrote to memory of 3824 4244 MoonHub.exe 96 PID 4244 wrote to memory of 3824 4244 MoonHub.exe 96 PID 4244 wrote to memory of 1184 4244 MoonHub.exe 98 PID 4244 wrote to memory of 1184 4244 MoonHub.exe 98 PID 4244 wrote to memory of 1388 4244 MoonHub.exe 100 PID 4244 wrote to memory of 1388 4244 MoonHub.exe 100 PID 4244 wrote to memory of 5068 4244 MoonHub.exe 102 PID 4244 wrote to memory of 5068 4244 MoonHub.exe 102 PID 4244 wrote to memory of 3960 4244 MoonHub.exe 104 PID 4244 wrote to memory of 3960 4244 MoonHub.exe 104 PID 4244 wrote to memory of 2172 4244 MoonHub.exe 106 PID 4244 wrote to memory of 2172 4244 MoonHub.exe 106 PID 4244 wrote to memory of 2372 4244 MoonHub.exe 108 PID 4244 wrote to memory of 2372 4244 MoonHub.exe 108 PID 4244 wrote to memory of 1116 4244 MoonHub.exe 110 PID 4244 wrote to memory of 1116 4244 MoonHub.exe 110 PID 1116 wrote to memory of 3384 1116 cmd.exe 112 PID 1116 wrote to memory of 3384 1116 cmd.exe 112 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2968 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\resembleC2.exe"C:\Users\Admin\AppData\Local\Temp\resembleC2.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\resemble.exe"C:\Users\Admin\AppData\Local\Temp\resemble.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4924
-
-
-
C:\Users\Admin\AppData\Local\Temp\MoonHub.exe"C:\Users\Admin\AppData\Local\Temp\MoonHub.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:464
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\MoonHub.exe"3⤵
- Views/modifies file attributes
PID:2968
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MoonHub.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1388
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵PID:5068
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵PID:3960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
PID:2372
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\MoonHub.exe" && pause3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\system32\PING.EXEping localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3384
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3288
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
1KB
MD597040f560821a95c4439d1335f23146e
SHA10fbff66fffa58e78b775a8bd325156dd5c8ef7d9
SHA256d4704b8aefda362ca72b0a6a56b28b6838ae9e1ac0fefdd2add970253455366a
SHA51299721741cd9ad00800fa375600c7fd3f59e58f1de4cd037971ce63d79ce12856200181bef08d01252b36852e2e2a55347ba0c2ad347319da7f79f1e473b9ea6f
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
948B
MD574a6b79d36b4aae8b027a218bc6e1af7
SHA10350e46c1df6934903c4820a00b0bc4721779e5f
SHA25660c64f6803d7ad1408d0a8628100470859b16ef332d5f1bd8bb2debe51251d04
SHA51260e71435a9a23f4c144d641844f4182ddc9aa4ccd3e99232149a187112dce96458aab9587e9fea46f5dc5a52f5ca758969a04657a2b5b10241d3e4554f7c85e0
-
Filesize
231KB
MD5f70b5e56a09af292d4e909c547f9c8c0
SHA1577883bdbe8dc9582e15e7a1212b1fe432bafce3
SHA2568fd22c5acb3144dbaa5ab3f9dd5901eb6f3beef67e72ea431246c6a790c067de
SHA512e54ccb56aa6473abd3530493933d5164f2dff02076e0f03443382f02d177a52e318d8d0f432e6a3fb5620eaffd09f2dbf6ccbf9698ba149b149c594fa162d879
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
845KB
MD556edb111575113d40af0f1c028dcb315
SHA1018a7abc977ba73e2f66f1e7bf041191089c100c
SHA256c7b542ac39e8e5a14ef0cd70dc3bb505cbdbef4d737c7cb310353642ca914235
SHA5122c87ad1db2ce3745426eb47e76b855124e97747d895d8f5b90adf9018a03c6059dc96537429cf03e2d9af51ca49b751c418820d7a27557e33b8ef54f7305c406