Analysis Report http://45.147.229.199:4444

Overview

General Information

Sample URL:	http://45.147.229.199:4444
Analysis ID:	358571
Infos:
Most interesting Screenshot:
Errors URL not reachable

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Uses known network protocols on non-standard ports

Classification

Signatures

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Networking:

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 4444
Source: unknown	Network traffic detected: HTTP traffic on port 4444 -> 49711

Source: unknown	TCP traffic detected without corresponding DNS query: 45.147.229.199
Source: unknown	TCP traffic detected without corresponding DNS query: 45.147.229.199
Source: unknown	TCP traffic detected without corresponding DNS query: 45.147.229.199
Source: unknown	TCP traffic detected without corresponding DNS query: 45.147.229.199
Source: unknown	TCP traffic detected without corresponding DNS query: 45.147.229.199
Source: unknown	TCP traffic detected without corresponding DNS query: 45.147.229.199
Source: unknown	TCP traffic detected without corresponding DNS query: 45.147.229.199
Source: unknown	TCP traffic detected without corresponding DNS query: 45.147.229.199

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: 45.147.229.199:4444Connection: Keep-Alive

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Feb 2021 20:21:22 GMTContent-Type: text/plainContent-Length: 0

Source: ~DFAD2EAEA6D1E49FEB.TMP.1.dr	String found in binary or memory: http://45.147.229.199:4444/
Source: {750CA48A-77F2-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: http://45.147.229.199:4444/Root

Source: classification engine

Classification label: sus20.troj.win@3/14@0/1

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF1E8AB9167246D8B5.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5652 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5652 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 4444
Source: unknown	Network traffic detected: HTTP traffic on port 4444 -> 49711

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.147.229.199	unknown	Germany		30823	COMBAHTONcombahtonGmbHDE	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.147.229.199:4444/	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

ID:	358571
Product:	CloudBasic
Start time:	21:20:35
Start date:	25.02.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{750CA488-77F2-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	FC83F0FFFC4DF5BFC0FF6644F69C2770	A496B99CDA77634546505A7355078F1C60DC2CB9	5B17313A3C5FD87A4E189075C392E4EDC82C54C9B083F4BB1D99559B1C83A92F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{750CA48A-77F2-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	6E3901F47B55BA90BD7B9C0F963D6D7A	51D32961B84F12A944E809CAD083726B29E91040	FCAD6A3A51B30A64458EBCA9952B692C17B4C6F80F35541986E77D21BFCF74C3
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{750CA48B-77F2-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	7811DDC60F0B7868721566F6154C22EC	4B0320AD6626F8420544CB281C9EA622FFD00C1A	939C38EC62784FC95B5D7EB78E087D2337E66ACF4A26E30701B67FBBAFB9EA24
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\down[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	C4F558C4C8B56858F15C09037CD6625A	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\ErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	F4FE1CB77E758E1BA56B8A8EC20417C5	F4EDA06901EDB98633A686B11D02F4925F827BF0	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\bullet[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	26F971D87CA00E23BD2D064524AEF838	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\background_gradient[1]	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3	20F0110ED5E4E0D5384A496E4880139B	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\http_404[1]	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	F65C729DC2D457B7A1093813F1253192	5006C9B50108CF582BE308411B157574E5A893FC	B82BFB6FA37FD5D56AC7C00536F150C0F244C81F1FC2D4FEFBBDC5E175C71B4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\info_48[1]	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced	5565250FCC163AA3A79F0B746416CE69	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
C:\Users\user\AppData\Local\Temp\~DF1E8AB9167246D8B5.TMP	data	87FF4B24035EE8598D060BB272C01B42	54D94FDFA2E7CCDFAE63A7245AA909826054586E	90F6442F05A6A25317214223B6516F6C6398AADEE815B99EE16792289C06C776
C:\Users\user\AppData\Local\Temp\~DFA3F02AE3705DA3AE.TMP	data	0CA724348996C2B740664F42D5FC7EAB	12FDB62B0C4148FCE7FA10608490525F31664167	A43D8ADF6D35C037CF5AC3D2543725AA17D427DDA72F84C562E2029ECBDC08FF
C:\Users\user\AppData\Local\Temp\~DFAD2EAEA6D1E49FEB.TMP	data	A81A6BA2BAC6F818AF26C8301136B40C	6E18846EE585093C00601FDF63806ECBBE2A0BA8	243D1C9A1DCD32A9567E8A9B0B0774093106A13B90ACB359AF268DCA822655A4

Analysis Report http://45.147.229.199:4444

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs