File name:

2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe

Full analysis: https://app.any.run/tasks/bd3cd99a-57a8-4ea4-9456-c1ac677ce77b
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 03:17:34
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

3BD6E630C3D5BF7CCA5C948CCEF44D81

SHA1:

6A0074A24C98EE2E7DC00D113B4417769EBA92E8

SHA256:

2CCCDC51AEA02049DC7F96F510A13311F112096A7D870A97D70232356DDEF42B

SSDEEP:

3072:8Xb8b1xNn4/1/vG1u+SUBuXDA84vSZgNywr3EOZ2ChAb51pgnVKXhviSXnR8D:wmvNE1XLjX02Zi6y2C29sn8ZiSXR8D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • iexplore.exe (PID: 4976)
      • iexplore.exe (PID: 4608)
      • iexplore.exe (PID: 7152)
      • iexplore.exe (PID: 3032)
      • iexplore.exe (PID: 5868)
      • iexplore.exe (PID: 744)
      • iexplore.exe (PID: 1328)
      • iexplore.exe (PID: 4012)
      • iexplore.exe (PID: 1184)
      • iexplore.exe (PID: 6712)
      • iexplore.exe (PID: 6908)
      • iexplore.exe (PID: 2796)

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 4608)
      • iexplore.exe (PID: 4976)
      • iexplore.exe (PID: 7152)
      • iexplore.exe (PID: 3032)
      • iexplore.exe (PID: 5868)
      • iexplore.exe (PID: 744)
      • iexplore.exe (PID: 1184)
      • iexplore.exe (PID: 1328)
      • iexplore.exe (PID: 4012)
      • iexplore.exe (PID: 6908)
      • iexplore.exe (PID: 2796)
      • iexplore.exe (PID: 6712)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 4976)
      • iexplore.exe (PID: 4608)
      • iexplore.exe (PID: 7152)
      • iexplore.exe (PID: 3032)
      • iexplore.exe (PID: 5868)
      • iexplore.exe (PID: 4012)
      • iexplore.exe (PID: 1328)
      • iexplore.exe (PID: 1184)
      • iexplore.exe (PID: 6908)
      • iexplore.exe (PID: 744)
      • iexplore.exe (PID: 6712)
      • iexplore.exe (PID: 2796)

  • INFO

    • Checks supported languages

      • ielowutil.exe (PID: 4776)
      • 2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe (PID: 5324)

    • Reads the computer name

      • ielowutil.exe (PID: 4776)
      • 2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe (PID: 5324)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 5640)

    • Reads the software policy settings

      • slui.exe (PID: 5024)
      • slui.exe (PID: 1852)

    • Checks proxy server information

      • slui.exe (PID: 1852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (64.2)
.dll | Win32 Dynamic Link Library (generic) (15.6)
.exe | Win32 Executable (generic) (10.6)
.exe | Generic Win/DOS Executable (4.7)
.exe | DOS Executable Generic (4.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:10:09 10:25:30+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 159744
InitializedDataSize: 16384
UninitializedDataSize: 4972544
EntryPoint: 0x4e57b0
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
176
Monitored processes
31
Malicious processes
15
Suspicious processes
7

Behavior graph

Click at the process to see the details
start 2019-04-02-ursnif-retrieved-by-windows-infected-host.exe sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
744"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5164 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
812"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1184"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4572 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1328"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3100 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1852C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2796"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6592 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3032"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6112 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3100"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3676"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3968"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
46 623
Read events
46 309
Write events
260
Delete events
54

Modification events

(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{BEB98CED-0927-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
Executable files
0
Suspicious files
54
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4976iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
6132iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{F1FFC80E-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:ED96B882C06E24CFEC172BA8570FAF80
SHA256:5D7E3933274CCD3221BCB13643930009320C09C8E9FC39464F89777D4009D661
6516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{D83AB108-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:B8D0405565799216501B3D9A1D824CEC
SHA256:6193AE31DE56933C78E1EEAE2EABD11F7E5E2BD56C9A02F0C4793BDC832D280E
6112iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF4784084C7C2FE5B0.TMPbinary
MD5:9C6FE47939CB8E86D481B9798111B303
SHA256:99626CC191CF84E3BC94783E9F80012D0F0A90F35A24E215A2A03227794BB2C4
6112iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{E512804F-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:94E3EF1E1709108B99D67F94882D1CE9
SHA256:136D4E5B7839BE6F856157D7B04EE8A429836443A39ABE79BB1B86B0DB6ECA10
6132iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFB86DDB2162198381.TMPbinary
MD5:575C495DC5FFC1BB96F157D009A7AF10
SHA256:495B4EB405547D52CC05EABAED670BD6DF79F2E4864C4BF164DD8D0BA74E3CE3
6540iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF9ECFE6B6FABA9191.TMPbinary
MD5:7E90860D1229D9199C5AC5E437FB23C4
SHA256:A4C900B1EFE9CD13921B6DD81B215E22F10FE6EE943315EC1C9D850EBC62B0B2
5640iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF52227C0EF8091824.TMPbinary
MD5:43A2DB05461866BA7C0A511FE4FD9313
SHA256:F09A456BD1EC427D60FDCF2CEDF80BD3B0ED1139847873E7A1327B2246903101
6540iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{FEE84F6D-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:07B3A5E04878A3212AC27402A1EC5771
SHA256:E6A6EDAC79D85C535B0C3751CC2C13FFE9967C5F8E0C35DCA316C7A323828849
5640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{BEB98CED-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:56EAB68C0D64D071CE9F10E0F2D4412F
SHA256:323E31ADFFFC89D2F0F059366E2B14E268810C8AF055FA607A47B4E56E2D0EA0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
93
DNS requests
36
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4976
iexplore.exe
GET
404
49.13.77.253:80
http://beetfeetlife.bit/webstore/86gZmZkKw/Uh4NLVpsF3Eme6znGSN2/LhhaW7LulCOLIYfs8Pw/78OCfvLhRVmNH2fceRdq_2/FnbtwOFd_2FVP/EPuWooUZ/5_2FW6rlTfHgQbjoThvXk8s/v93lPBBBmP/gsNpAjqp1cswx90Ib/eFa6gj1gmZzC/hrbrSUMwRez/tgj2nfJUKQIRY4/K4Z3N8Ux97Ij0JnrNIMvo/qM1SwCpYkAmnq3nmG/NA_2FG
unknown
—
—
malicious
3032
iexplore.exe
GET
404
49.13.77.253:80
http://beetfeetlife.bit/webstore/71JHOkHNSCz9ym/qmG5POrMlYG1fsW9_2FWd/VzOzTFhcT291yvlq/ioyIF9tPRze7UxM/pYbUJmHbSXpOeu26EI/dEYluQUsm/qRiI4TSvL2IdAoDaeaXx/qDEOQ_2Bb53m5UgapX8/mJK7zjw63kMEIjtL3_2FW7/NcX47TQs0FfXC/RpiUrdaA/n3izcsUw9K5a_2FXfsHJIYs/jgxdZOBLYr/KIs6WBUBwSl/koi
unknown
—
—
malicious
4608
iexplore.exe
GET
404
49.13.77.253:80
http://supp.rivier.at/webstore/qal0q2XFQhpk/5hgRKGrZb8k/6Z_2BUm26MJyd7/8qQmEtvoaVhYhg0HlWhle/DaALhmNhogiS_2FR/qWHb_2BkjDJXWsQ/NJlyVkMJaPeWkebMrX/sRhLxq_2F/xZBCU57w2ENWXPCpdbb7/JXbhvMJ7X0H2GqKGqe3/CbtosCeb1XzLRilj6XHZaW/6NKoQMOpnPopb/irN892xU/CG8nUi8tplVvsF0absn9fyu/d
unknown
—
—
malicious
5756
iexplore.exe
GET
404
49.13.77.253:80
http://api.sorna.at/webstore/AzMpPAm4GcowjCGLKdOtT/0NSAlgO6BzuEDcNr/hJJ6hdBkBZZKAQH/rr92LO4ftLGySohkZB/o_2F5OMvR/oAyHHgokOm_2FCc_2FLj/QqfBil0eMYV30Ku6u7T/yEfV3ZvH3hjnpwJZL_2BoH/LP_2FiK73_2B_/2BilJIg9/H7gkOj3eFJIv1L0C8PB_2FS/h0thSD8nBh/agw08iCPAZKZzyFyl/ZLx0SRi3y_2BKOf2Mmi8/8
unknown
—
—
malicious
744
iexplore.exe
GET
404
49.13.77.253:80
http://api.sorna.at/webstore/tSTQ_2Fm/9XNw9zUaRRrbOyVMSTSDNib/xIymIVxl6S/ljtkFbdQ5H_2BCmhD/r68d_2F0wRs_/2BoM0PFtCXk/v54NuQuKcj4WbL/cEjrTzxASII595deaKGW9/Ax8m_2FDbiQIGPeV/1r20mFSt8Rym_2B/5bcyIKD8POos7KF66r/4MfFe4Pw_/2B9Z1KGEuyn0WLkOgV5e/zYJMdmQQk5MwaHh5wuJ/DVqFhr_2/B8iU88Fo/s
unknown
—
—
malicious
5868
iexplore.exe
GET
404
49.13.77.253:80
http://beetfeetlife.bit/webstore/DyPlyd44X/J54Cnq0JFuGBiocURVal/mI7yQfFJ8quK4Wleudw/qltDq8fDF2EkaCaWol1FY6/9D2eR4Kzj5c_2/BWr2vplU/FizA5ZkCNM7DxJkTsuYbByc/G5UmnmHnvr/ubx0PhwC_2BGip_2B/pG27nadh_2Bx/CYy2ULqZEI7/WIaxC6sPq49BPn/du4r3M_2BgOEexKqdjOqw/r1PdfXyiCQrwyc7i/hixAta0D/N
unknown
—
—
malicious
7152
iexplore.exe
GET
404
49.13.77.253:80
http://supp.rivier.at/webstore/Co0IPqGy0uxomcceMjy/O8_2FCbfjQ_2BUbxkr6Sf8/PB83tf11dBErb/RQlzFOR0/P1izjbhe068luAEBgwF18w8/fhWEDPzuzW/qBIbKRvA4d_2BRvLL/G_2BKUzk2Nf5/EoXXz4YiN5a/8swFu_2FBH5mXj/6b8lSDJUKwkykccmBUige/45lb_2BG4qTPzLjj/VOxCSvWGbdy_2B0/TW4tqBZtQF19KMKw59/eHcTa_2Fig/K
unknown
—
—
malicious
1328
iexplore.exe
GET
404
49.13.77.253:80
http://supp.rivier.at/webstore/_2BGpdmhzaU2kvcL_2FTb9/WGIyTvaZDTJqI/ejTOLnKx/QpSYtntBDju8BDOowe1ie28/WdqtH2ChOk/96llimvOepxWL8aaD/lR1XHHILqJM6/sujLefLBjtI/HGdFow3AS7Phh5/Af_2BRqi5mNKc0yscg7UH/F1RTCp5TxZRsFDKo/zM2h24iN8nIhNKv/a41RRv82DAP9mi3RUC/YV9xRSKb_2FZDqnizAxwj/A
unknown
—
—
malicious
4012
iexplore.exe
GET
404
49.13.77.253:80
http://beetfeetlife.bit/webstore/FxtG7bOA/Yv_2FQO0_2FGlA6rbG_2Fk_/2FQ2tOJrsp/37jDM78nnrDf9baKx/h5ZYUPU3X4MM/nkkYjBKuB7t/2HCo3_2BX67xEd/IQoNYUiLF45m6_2Fw3EPS/xnItFV5_2FWeZNBV/ifYCDu_2FPTp6DG/E5Xqz_2F5sOH2DSRjy/CaO4CJWPa/fmN8D6rDmdTbOIhzmbuy/q2HPCZ1Bmgtk_2Fehff/OS3guRYvHp8CIT5_2F_2FH/iBYEie8bqgtlx/3lzTg2nCeg/X
unknown
—
—
malicious
2796
iexplore.exe
GET
404
49.13.77.253:80
http://beetfeetlife.bit/webstore/PVqFL_2FJXr4WYys/CgQVJIvZfwWZ0Bo/bvh4CFJfJb4rYR2g8I/Bsm2xew5y/M5Dyr9N6onCrLYTrKEBf/Bf3rJS6kmjfpkcb_2Fq/ou2ptQ39j7rAg4RmD7ZeVr/6T0LY_2FbVjfO/gzGSOZI_/2F2rc_2F93XaHBZ2Gva_2Bh/uKEATu0M3a/HZsMWi_2Fn4FvJgue/1SFlMELXCSCN/nuxmTd5fEmf/OKKCJeCuFJi1h9/C
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6700
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4976
iexplore.exe
49.13.77.253:80
beetfeetlife.bit
Hetzner Online GmbH
DE
malicious
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.46
whitelisted
beetfeetlife.bit
  • 49.13.77.253
malicious
client.wns.windows.com
  • 40.113.110.67
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.76
  • 20.190.160.17
  • 20.190.160.2
  • 20.190.160.22
  • 20.190.160.4
  • 40.126.32.140
whitelisted
arc.msn.com
  • 20.199.58.43
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
  • 2603:1030:408:7::3d
whitelisted
198.187.3.20.in-addr.arpa
  • —
unknown
d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
5324
2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
4976
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
4608
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5324
2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
3032
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
5868
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5868
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
7152
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
7152
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
5324
2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe