Overview
overview
10Static
static
3resemblec2.exe
windows7-x64
10resemblec2.exe
windows10-2004-x64
7resemblec2.exe
android-9-x86
resemblec2.exe
android-10-x64
resemblec2.exe
android-11-x64
resemblec2.exe
macos-10.15-amd64
resemblec2.exe
ubuntu-18.04-amd64
resemblec2.exe
debian-9-armhf
resemblec2.exe
debian-9-mips
resemblec2.exe
debian-9-mipsel
Analysis
-
max time kernel
888s -
max time network
893s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-01-2025 04:02
Static task
static1
Behavioral task
behavioral1
Sample
resemblec2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
resemblec2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
resemblec2.exe
Resource
android-x86-arm-20240624-en
android-9-x86
Behavioral task
behavioral4
Sample
resemblec2.exe
Resource
android-x64-20240910-en
android-10-x64
Behavioral task
behavioral5
Sample
resemblec2.exe
Resource
android-x64-arm64-20240624-en
android-11-x64
Behavioral task
behavioral6
Sample
resemblec2.exe
Resource
macos-20241106-en
macos-10.15-amd64
Behavioral task
behavioral7
Sample
resemblec2.exe
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
resemblec2.exe
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral9
Sample
resemblec2.exe
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral10
Sample
resemblec2.exe
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
General
-
Target
resemblec2.exe
-
Size
670KB
-
MD5
a7816959bd66c9c1de58176164a9a346
-
SHA1
828184b97df950a1ca6288b7693ee35c5c4193b7
-
SHA256
e607e52cb362cdca751c9cf27c91b8f5087649c720d49fd31ee925176107e501
-
SHA512
b510573b0a7679534c331b70b9c338ed62c8b3907474209fa91567f9e5884137cce981e5aa95fad424d1f81f1bc54012437745d9dd05936268e48796581376bd
-
SSDEEP
12288:DwXfR1kAiLQSeSiDrSBOsHENlXme4ylVUGpR9UR7BDF66zL/wVh/4ixdgWrE8qnD:DwvR1kkSebDedE3X/lvpR9U/Ft/Ch/v4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation resemblec2.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation idk.exe -
Executes dropped EXE 2 IoCs
pid Process 4636 idk.exe 4944 AudioDriver.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini idk.exe File opened for modification C:\Windows\assembly\Desktop.ini idk.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
flow ioc 56 6.tcp.eu.ngrok.io 62 6.tcp.eu.ngrok.io 81 6.tcp.eu.ngrok.io 45 6.tcp.eu.ngrok.io 87 6.tcp.eu.ngrok.io 94 6.tcp.eu.ngrok.io 100 6.tcp.eu.ngrok.io 112 6.tcp.eu.ngrok.io 124 6.tcp.eu.ngrok.io 14 6.tcp.eu.ngrok.io 64 6.tcp.eu.ngrok.io 70 6.tcp.eu.ngrok.io 106 6.tcp.eu.ngrok.io 118 6.tcp.eu.ngrok.io 130 6.tcp.eu.ngrok.io -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly idk.exe File created C:\Windows\assembly\Desktop.ini idk.exe File opened for modification C:\Windows\assembly\Desktop.ini idk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings resemblec2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe 4944 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4944 AudioDriver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4944 AudioDriver.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4944 AudioDriver.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1180 OpenWith.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 316 wrote to memory of 4636 316 resemblec2.exe 84 PID 316 wrote to memory of 4636 316 resemblec2.exe 84 PID 316 wrote to memory of 4636 316 resemblec2.exe 84 PID 4636 wrote to memory of 4944 4636 idk.exe 86 PID 4636 wrote to memory of 4944 4636 idk.exe 86 PID 4636 wrote to memory of 4944 4636 idk.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\resemblec2.exeC:\Users\Admin\AppData\Local\Temp\resemblec2.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\idk.exe"C:\Users\Admin\AppData\Local\Temp\idk.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4944
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
845KB
MD5c0f4b33fab9864dfebccb1f7621ac76a
SHA19e65684a22bae25570f019366657a83522434590
SHA256ce59e3370985a4b7f243de0fb67848bcb223781077dee528e2f4adb8e9d8d656
SHA5126cd5672e2b3615ebb94fb96de29fe1b2cbfa81c1e18080ad6fbb48b25457481e17d8919823970e5bd1e230e2e8c76d379a515551e35bdc10f305d3349ab3cefe