Analysis Report http://csync.loopme.me

Overview

General Information

Sample URL:	http://csync.loopme.me
Analysis ID:	329311
Most interesting Screenshot:
Errors URL not reachable

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: csync.loopme.meConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: csync.loopme.me

Source: ~DF3C658F349ADA4E7C.TMP.1.dr	String found in binary or memory: http://csync.loopme.me/
Source: {B6A5DF52-3B75-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: http://csync.loopme.me/Root

Source: classification engine

Classification label: unknown0.win@3/13@1/1

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF318CC959D73D0E6D.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3096 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3096 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior

Click here to start
Slideshow Behavior Animation

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
116.202.114.114	unknown	Germany		24940	HETZNER-ASDE	false

Contacted Domains

Name	IP	Active
generic.lb.lm5v.com	116.202.114.114	true
csync.loopme.me	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://csync.loopme.me/	false		high

ID:	329311
Product:	CloudBasic
Start time:	21:56:26
Start date:	10.12.2020
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B6A5DF50-3B75-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	93DE3DC06E7B086A82853E81D1C6A08E	A2AF82BF9EF4AAC6E83D94457E825AE3AC26C8F8	06544018B2AE36DB33F4899F11E471BCFE449D11070C86B04C861A2672E7EAED
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B6A5DF52-3B75-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	295521BFF46B5766B20C4C08267B4C99	93686E074CD495BA5B83C32254EA0B0BCA751337	FF49225E7174027B72D142CB5D45AB83EC6959D63ABCF53DE6F4975968B77903
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B6A5DF53-3B75-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	B207317F5D93800420EE80FC0FA9DCB9	F1FC1F118C373F98C2227325923DEA0F1D632C38	37CD982E24393BFF288ED7ED51CD40D42EB69E7BDD20AE21E2592779A2782C26
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\background_gradient[1]	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3	20F0110ED5E4E0D5384A496E4880139B	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D65EC06F21C379C87040B83CC1ABAC6B	208D0A0BB775661758394BE7E4AFB18357E46C8B	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\ErrorPageTemplate[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	F4FE1CB77E758E1BA56B8A8EC20417C5	F4EDA06901EDB98633A686B11D02F4925F827BF0	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\bullet[1]	PNG image data, 15 x 15, 8-bit colormap, non-interlaced	26F971D87CA00E23BD2D064524AEF838	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\httpErrorPagesScripts[1]	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9234071287E637F85D721463C488704C	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\info_48[1]	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced	5565250FCC163AA3A79F0B746416CE69	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\navcancl[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	4BCFE9F8DB04948CDDB5E31FE6A7F984	42464C70FC16F3F361C2419751ACD57D51613CDF	BEE0439FCF31DE76D6E2D7FD377A24A34AC8763D5BF4114DA5E1663009E24228
C:\Users\user\AppData\Local\Temp\~DF318CC959D73D0E6D.TMP	data	F6DA78282DF1FD0CC0E96C6ADFA62D7B	3B2DE5E0A04C68A2ED66611A1539647DF6BF58E5	372E9A800E878C66EA66F12EDCE6FF58FB12254996986C57281533A5A5AC1847
C:\Users\user\AppData\Local\Temp\~DF3C658F349ADA4E7C.TMP	data	652F492F7D87E8C7F53AEFC5BE2FAD63	9778877A0B403B95EE321A0D39C2AF4203900BE5	7C35E9078297CD1EFD509C9D47CF465BAC0D120895F1D46EC6D3B0CF4FADDFDC
C:\Users\user\AppData\Local\Temp\~DFBA6BCE1E3C27B51D.TMP	data	44406CF3D657BB0D6B5C5FF4EE04FF73	A75910E6F4B28D21315D55CDE530BC02D8F3AFB3	54559846C66D77DB0C76A1D4D4D5D52A9F436131C427C028F748C332D5EB7FE2

Analysis Report http://csync.loopme.me

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs