Overview

overview

3

Static

static

1

abcdefgRemus.zip

windows7-x64

1

abcdefgRemus.zip

windows10-2004-x64

1

blob/{3a30...}.blob

windows7-x64

3

blob/{3a30...}.blob

windows10-2004-x64

3

blob/{5b9c...}.blob

windows7-x64

3

blob/{5b9c...}.blob

windows10-2004-x64

3

images/{1d...f}.png

windows7-x64

3

images/{1d...f}.png

windows10-2004-x64

3

images/{21...d}.png

windows7-x64

3

images/{21...d}.png

windows10-2004-x64

3

images/{3b...c}.png

windows7-x64

3

images/{3b...c}.png

windows10-2004-x64

3

images/{91...0}.png

windows7-x64

3

images/{91...0}.png

windows10-2004-x64

3

images/{cd...6}.png

windows7-x64

3

images/{cd...6}.png

windows10-2004-x64

3

images/{ce...1}.png

windows7-x64

3

images/{ce...1}.png

windows10-2004-x64

3

project.xml

windows7-x64

3

project.xml

windows10-2004-x64

1

versions.xml

windows7-x64

3

versions.xml

windows10-2004-x64

1

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/09/2024, 06:32 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    project.xml

  • Size

    1.9MB

  • MD5

    6c4df76b5f142db11e536d096c2097d9

  • SHA1

    044a3b0112c0eb52e035a405992f39a98d34cb87

  • SHA256

    e0edfb920ea6365eab889b68b9e016f46179f36081270ed84dc52488e7cae52f

  • SHA512

    def9ad3517da6d20bc78b326b2cf626acb3e9c0b869cc7db581d88fe0a5c709e8add4215f81056fc48ea11dd8510a6a2eaf8772ec150c3d78740a361cb27651b

  • SSDEEP

    1536:Jl+yPpM09f2K0gye4CmYD0Xlj/hSi4NftF:Nf2sWBx/+F

Score
1/10

Malware Config

Signatures

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\project.xml"
    1⤵
      PID:3292

    Network

    • flag-us
      DNS
      149.220.183.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      149.220.183.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      74.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      74.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      157.123.68.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      157.123.68.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      23.236.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      23.236.111.52.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      149.220.183.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      149.220.183.52.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      74.32.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      74.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      157.123.68.40.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      157.123.68.40.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      23.236.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      23.236.111.52.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3292-0-0x00007FF885E30000-0x00007FF885E40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3292-1-0x00007FF8C5E4D000-0x00007FF8C5E4E000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3292-3-0x00007FF8C5DB0000-0x00007FF8C5FA5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/3292-2-0x00007FF8C5DB0000-0x00007FF8C5FA5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/3292-4-0x00007FF8C5DB0000-0x00007FF8C5FA5000-memory.dmp

      Filesize

      2.0MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.