Analysis Report http://icon-adc.realsh.xyz

Overview

General Information

Sample URL: http://icon-adc.realsh.xyz
Analysis ID: 427162
Infos:

Most interesting Screenshot:
Errors
  • URL not reachable

Detection

Score: 20
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Performs DNS queries to domains with low reputation

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior

Networking:

barindex
Performs DNS queries to domains with low reputation
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe DNS query: icon-adc.realsh.xyz
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: icon-adc.realsh.xyzConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: icon-adc.realsh.xyz
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 31 May 2021 13:58:16 GMTContent-Length: 0Connection: keep-aliveCF-Cache-Status: DYNAMICcf-request-id: 0a6450e72a00004eb0c7b84000000001Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=uK8Xaevo5Iw8sfvE%2Fv%2FGbvVc2W%2FjYjETEjFqpHbfDE2UUxxD8dQDgelcVna%2FSI1lUmsx9IG7ANP2EVVjZtr6dAX76NRCNyDCDBWVrexf3re8d6ElpIlFX90KnANJkAjWRA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6580b751dded4eb0-FRAalt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Source: ~DFB1AAEA48B9293B2E.TMP.1.dr String found in binary or memory: http://icon-adc.realsh.xyz/
Source: {AD68DF7F-C263-11EB-90E6-ECF4BB82F7E0}.dat.1.dr String found in binary or memory: http://icon-adc.realsh.xyz/Root
Source: classification engine Classification label: sus20.troj.win@3/14@1/1
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AD68DF7D-C263-11EB-90E6-ECF4BB82F7E0}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user~1\AppData\Local\Temp\~DF3189524FBDA53A0D.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5540 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5540 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 427162 URL: http://icon-adc.realsh.xyz Startdate: 31/05/2021 Architecture: WINDOWS Score: 20 13 Performs DNS queries to domains with low reputation 2->13 6 iexplore.exe 1 51 2->6         started        process3 process4 8 iexplore.exe 38 6->8         started        dnsIp5 11 icon-adc.realsh.xyz 104.21.20.18, 49705, 49706, 80 CLOUDFLARENETUS United States 8->11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.20.18
 icon-adc.realsh.xyz United States
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
icon-adc.realsh.xyz 104.21.20.18 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://icon-adc.realsh.xyz/ false
  • Avira URL Cloud: safe
 unknown