File name:

2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe

Full analysis: https://app.any.run/tasks/bd3cd99a-57a8-4ea4-9456-c1ac677ce77b
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 03:17:34
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

3BD6E630C3D5BF7CCA5C948CCEF44D81

SHA1:

6A0074A24C98EE2E7DC00D113B4417769EBA92E8

SHA256:

2CCCDC51AEA02049DC7F96F510A13311F112096A7D870A97D70232356DDEF42B

SSDEEP:

3072:8Xb8b1xNn4/1/vG1u+SUBuXDA84vSZgNywr3EOZ2ChAb51pgnVKXhviSXnR8D:wmvNE1XLjX02Zi6y2C29sn8ZiSXR8D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • iexplore.exe (PID: 4976)
      • iexplore.exe (PID: 4608)
      • iexplore.exe (PID: 3032)
      • iexplore.exe (PID: 7152)
      • iexplore.exe (PID: 5868)
      • iexplore.exe (PID: 744)
      • iexplore.exe (PID: 1328)
      • iexplore.exe (PID: 4012)
      • iexplore.exe (PID: 1184)
      • iexplore.exe (PID: 2796)
      • iexplore.exe (PID: 6712)
      • iexplore.exe (PID: 6908)

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 4976)
      • iexplore.exe (PID: 4608)
      • iexplore.exe (PID: 3032)
      • iexplore.exe (PID: 7152)
      • iexplore.exe (PID: 744)
      • iexplore.exe (PID: 1328)
      • iexplore.exe (PID: 4012)
      • iexplore.exe (PID: 1184)
      • iexplore.exe (PID: 5868)
      • iexplore.exe (PID: 6712)
      • iexplore.exe (PID: 6908)
      • iexplore.exe (PID: 2796)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 4976)
      • iexplore.exe (PID: 4608)
      • iexplore.exe (PID: 3032)
      • iexplore.exe (PID: 7152)
      • iexplore.exe (PID: 5868)
      • iexplore.exe (PID: 1328)
      • iexplore.exe (PID: 744)
      • iexplore.exe (PID: 4012)
      • iexplore.exe (PID: 1184)
      • iexplore.exe (PID: 6712)
      • iexplore.exe (PID: 6908)
      • iexplore.exe (PID: 2796)

  • INFO

    • Reads the computer name

      • ielowutil.exe (PID: 4776)
      • 2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe (PID: 5324)

    • Checks supported languages

      • ielowutil.exe (PID: 4776)
      • 2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe (PID: 5324)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 5640)

    • Reads the software policy settings

      • slui.exe (PID: 5024)
      • slui.exe (PID: 1852)

    • Checks proxy server information

      • slui.exe (PID: 1852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (64.2)
.dll | Win32 Dynamic Link Library (generic) (15.6)
.exe | Win32 Executable (generic) (10.6)
.exe | Generic Win/DOS Executable (4.7)
.exe | DOS Executable Generic (4.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:10:09 10:25:30+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 159744
InitializedDataSize: 16384
UninitializedDataSize: 4972544
EntryPoint: 0x4e57b0
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
176
Monitored processes
31
Malicious processes
15
Suspicious processes
7

Behavior graph

Click at the process to see the details
start 2019-04-02-ursnif-retrieved-by-windows-infected-host.exe sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
744"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5164 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
812"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1184"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4572 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1328"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3100 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1852C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2796"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6592 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3032"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6112 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3100"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3676"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3968"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
46 623
Read events
46 309
Write events
260
Delete events
54

Modification events

(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{BEB98CED-0927-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(5640) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
Executable files
0
Suspicious files
54
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{BEB98CED-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:56EAB68C0D64D071CE9F10E0F2D4412F
SHA256:323E31ADFFFC89D2F0F059366E2B14E268810C8AF055FA607A47B4E56E2D0EA0
4976iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:38B736796AB27CAE94E2B7318EE2AAEE
SHA256:B90718E6725747987B4D4FADA096C955A65F544225E4FD3B045B94FEA63D7AA7
5640iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF52227C0EF8091824.TMPbinary
MD5:43A2DB05461866BA7C0A511FE4FD9313
SHA256:F09A456BD1EC427D60FDCF2CEDF80BD3B0ED1139847873E7A1327B2246903101
6516iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF0196D8DB0087DD31.TMPbinary
MD5:DCB652864FCFFD8D8D060717200F9F77
SHA256:C9F8FF9E6F2ED25F0CE86A9A7B683846FF1DF7F2F139517D462FC2E3C76F06AB
5640iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF1BE2B785BA075E8A.TMPbinary
MD5:34EEE81083C40E710B268536D26CE068
SHA256:CDBF458D6D5DA0228B3CE9D357CA82BD05D6782CE158349B49E12602C7CB2B84
6112iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{E5128051-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:96BE0F56B29983A07167F1291E7B5D66
SHA256:24B246ECDCC6309E1EDDA010707348D21421932A8AE609E3B7CB160DA38F942C
6516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{D83AB108-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:B8D0405565799216501B3D9A1D824CEC
SHA256:6193AE31DE56933C78E1EEAE2EABD11F7E5E2BD56C9A02F0C4793BDC832D280E
6112iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF4784084C7C2FE5B0.TMPbinary
MD5:9C6FE47939CB8E86D481B9798111B303
SHA256:99626CC191CF84E3BC94783E9F80012D0F0A90F35A24E215A2A03227794BB2C4
6112iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF7ACB4F8BCA871572.TMPbinary
MD5:8D4589A2D97C3110B863454C0CFCE0A7
SHA256:0007F8CDB7DC50307CFBCC83E1223C02E8D0C604A1141C788A93D1ABCC58B959
6516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{D83AB106-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:3415ACC9F8C48A1F88C4D3AC8F815F02
SHA256:04823783DDE379F6A0F973F2F05014DF05547467FFA108166EF863B8872A26ED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
93
DNS requests
36
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4976
iexplore.exe
GET
404
49.13.77.253:80
http://beetfeetlife.bit/webstore/86gZmZkKw/Uh4NLVpsF3Eme6znGSN2/LhhaW7LulCOLIYfs8Pw/78OCfvLhRVmNH2fceRdq_2/FnbtwOFd_2FVP/EPuWooUZ/5_2FW6rlTfHgQbjoThvXk8s/v93lPBBBmP/gsNpAjqp1cswx90Ib/eFa6gj1gmZzC/hrbrSUMwRez/tgj2nfJUKQIRY4/K4Z3N8Ux97Ij0JnrNIMvo/qM1SwCpYkAmnq3nmG/NA_2FG
unknown
—
—
malicious
4608
iexplore.exe
GET
404
49.13.77.253:80
http://supp.rivier.at/webstore/qal0q2XFQhpk/5hgRKGrZb8k/6Z_2BUm26MJyd7/8qQmEtvoaVhYhg0HlWhle/DaALhmNhogiS_2FR/qWHb_2BkjDJXWsQ/NJlyVkMJaPeWkebMrX/sRhLxq_2F/xZBCU57w2ENWXPCpdbb7/JXbhvMJ7X0H2GqKGqe3/CbtosCeb1XzLRilj6XHZaW/6NKoQMOpnPopb/irN892xU/CG8nUi8tplVvsF0absn9fyu/d
unknown
—
—
malicious
3032
iexplore.exe
GET
404
49.13.77.253:80
http://beetfeetlife.bit/webstore/71JHOkHNSCz9ym/qmG5POrMlYG1fsW9_2FWd/VzOzTFhcT291yvlq/ioyIF9tPRze7UxM/pYbUJmHbSXpOeu26EI/dEYluQUsm/qRiI4TSvL2IdAoDaeaXx/qDEOQ_2Bb53m5UgapX8/mJK7zjw63kMEIjtL3_2FW7/NcX47TQs0FfXC/RpiUrdaA/n3izcsUw9K5a_2FXfsHJIYs/jgxdZOBLYr/KIs6WBUBwSl/koi
unknown
—
—
malicious
5756
iexplore.exe
GET
404
49.13.77.253:80
http://api.sorna.at/webstore/AzMpPAm4GcowjCGLKdOtT/0NSAlgO6BzuEDcNr/hJJ6hdBkBZZKAQH/rr92LO4ftLGySohkZB/o_2F5OMvR/oAyHHgokOm_2FCc_2FLj/QqfBil0eMYV30Ku6u7T/yEfV3ZvH3hjnpwJZL_2BoH/LP_2FiK73_2B_/2BilJIg9/H7gkOj3eFJIv1L0C8PB_2FS/h0thSD8nBh/agw08iCPAZKZzyFyl/ZLx0SRi3y_2BKOf2Mmi8/8
unknown
—
—
malicious
7152
iexplore.exe
GET
404
49.13.77.253:80
http://supp.rivier.at/webstore/Co0IPqGy0uxomcceMjy/O8_2FCbfjQ_2BUbxkr6Sf8/PB83tf11dBErb/RQlzFOR0/P1izjbhe068luAEBgwF18w8/fhWEDPzuzW/qBIbKRvA4d_2BRvLL/G_2BKUzk2Nf5/EoXXz4YiN5a/8swFu_2FBH5mXj/6b8lSDJUKwkykccmBUige/45lb_2BG4qTPzLjj/VOxCSvWGbdy_2B0/TW4tqBZtQF19KMKw59/eHcTa_2Fig/K
unknown
—
—
malicious
5868
iexplore.exe
GET
404
49.13.77.253:80
http://beetfeetlife.bit/webstore/DyPlyd44X/J54Cnq0JFuGBiocURVal/mI7yQfFJ8quK4Wleudw/qltDq8fDF2EkaCaWol1FY6/9D2eR4Kzj5c_2/BWr2vplU/FizA5ZkCNM7DxJkTsuYbByc/G5UmnmHnvr/ubx0PhwC_2BGip_2B/pG27nadh_2Bx/CYy2ULqZEI7/WIaxC6sPq49BPn/du4r3M_2BgOEexKqdjOqw/r1PdfXyiCQrwyc7i/hixAta0D/N
unknown
—
—
malicious
744
iexplore.exe
GET
404
49.13.77.253:80
http://api.sorna.at/webstore/tSTQ_2Fm/9XNw9zUaRRrbOyVMSTSDNib/xIymIVxl6S/ljtkFbdQ5H_2BCmhD/r68d_2F0wRs_/2BoM0PFtCXk/v54NuQuKcj4WbL/cEjrTzxASII595deaKGW9/Ax8m_2FDbiQIGPeV/1r20mFSt8Rym_2B/5bcyIKD8POos7KF66r/4MfFe4Pw_/2B9Z1KGEuyn0WLkOgV5e/zYJMdmQQk5MwaHh5wuJ/DVqFhr_2/B8iU88Fo/s
unknown
—
—
malicious
1328
iexplore.exe
GET
404
49.13.77.253:80
http://supp.rivier.at/webstore/_2BGpdmhzaU2kvcL_2FTb9/WGIyTvaZDTJqI/ejTOLnKx/QpSYtntBDju8BDOowe1ie28/WdqtH2ChOk/96llimvOepxWL8aaD/lR1XHHILqJM6/sujLefLBjtI/HGdFow3AS7Phh5/Af_2BRqi5mNKc0yscg7UH/F1RTCp5TxZRsFDKo/zM2h24iN8nIhNKv/a41RRv82DAP9mi3RUC/YV9xRSKb_2FZDqnizAxwj/A
unknown
—
—
malicious
4012
iexplore.exe
GET
404
49.13.77.253:80
http://beetfeetlife.bit/webstore/FxtG7bOA/Yv_2FQO0_2FGlA6rbG_2Fk_/2FQ2tOJrsp/37jDM78nnrDf9baKx/h5ZYUPU3X4MM/nkkYjBKuB7t/2HCo3_2BX67xEd/IQoNYUiLF45m6_2Fw3EPS/xnItFV5_2FWeZNBV/ifYCDu_2FPTp6DG/E5Xqz_2F5sOH2DSRjy/CaO4CJWPa/fmN8D6rDmdTbOIhzmbuy/q2HPCZ1Bmgtk_2Fehff/OS3guRYvHp8CIT5_2F_2FH/iBYEie8bqgtlx/3lzTg2nCeg/X
unknown
—
—
malicious
1184
iexplore.exe
GET
404
49.13.77.253:80
http://api.sorna.at/webstore/32ZWzzRLxEMLP/7hEQdPT0/XCXwzl6qthgryaHed4dDfsI/wmFZQrvQfu/8Ngf_2Bbfz3N2v332/16vxV_2Bll_2/BGfjxJynCMC/PuN5btH2afBzzR/dvIXYVllH703KbWTE5djB/5TdCc2GRQPCCjLYs/8bc_2BbjVkSZrXM/dqZV471ufVCr41QDxU/Tn2JjNmzf/n8HsLCCq7Uem4CLX6Nm3/bfVR4PDd/5VTUXjT
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6700
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4976
iexplore.exe
49.13.77.253:80
beetfeetlife.bit
Hetzner Online GmbH
DE
malicious
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.46
whitelisted
beetfeetlife.bit
  • 49.13.77.253
malicious
client.wns.windows.com
  • 40.113.110.67
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.76
  • 20.190.160.17
  • 20.190.160.2
  • 20.190.160.22
  • 20.190.160.4
  • 40.126.32.140
whitelisted
arc.msn.com
  • 20.199.58.43
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
  • 2603:1030:408:7::3d
whitelisted
198.187.3.20.in-addr.arpa
  • —
unknown
d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
5324
2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
4976
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
4608
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5324
2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
3032
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
5868
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5868
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
7152
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
7152
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
5324
2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-04-02-Ursnif-retrieved-by-Windows-infected-host.exe