File name:

2019-08-31-Trickbot-gtag-leo10-retrieved-by-Ursnif-infected-host.exe

Full analysis: https://app.any.run/tasks/423cc3e1-7ade-4336-97b5-09fccdedb1be
Verdict: Malicious activity
Threats:

TrickBot is an advanced banking trojan that attackers can use to steal payment credentials from the victims. It can redirect the victim to a fake banking cabinet and retrieve credentials typed in on the webpage.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 06:21:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
trickbot
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

D747EFC26F7536467CD2F098E44E5362

SHA1:

48150F3ECDA11BEA238900BA8CFE5923411C35DB

SHA256:

3E178CA9F660200D6452619F37D8864DA5289B1B0848C81280D2091235F0DECB

SSDEEP:

24576:V/Z7FlmdP9vSXoWf4mSjz1j3XxwBLDmS9aYs3yYiGZB:V/Z7FlmdP9vSXoWf4mSjz1j3XxwBLDm5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • TRICKBOT mutex has been found

      • svchost.exe (PID: 3304)
      • svchost.exe (PID: 5400)

    • Known privilege escalation attack

      • dllhost.exe (PID: 5408)

    • TRICKBOT has been detected (YARA)

      • svchost.exe (PID: 5400)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • svchost.exe (PID: 3304)

    • The process executes via Task Scheduler

      • 2019-08-31-Vticmbqt-gtag-neq10-tettieved-by-Wtupif-ipfected-hqut.exe (PID: 1128)

    • Connects to unusual port

      • svchost.exe (PID: 5400)

  • INFO

    • Reads the computer name

      • 2019-08-31-Trickbot-gtag-leo10-retrieved-by-Ursnif-infected-host.exe (PID: 5956)

    • The sample compiled with english language support

      • 2019-08-31-Trickbot-gtag-leo10-retrieved-by-Ursnif-infected-host.exe (PID: 5956)
      • svchost.exe (PID: 3304)

    • Checks supported languages

      • 2019-08-31-Trickbot-gtag-leo10-retrieved-by-Ursnif-infected-host.exe (PID: 5956)
      • 2019-08-31-Trickbot-gtag-leo10-retrieved-by-Ursnif-infected-host.exe (PID: 4040)
      • 2019-08-31-Vticmbqt-gtag-neq10-tettieved-by-Wtupif-ipfected-hqut.exe (PID: 1128)

    • Reads the machine GUID from the registry

      • 2019-08-31-Trickbot-gtag-leo10-retrieved-by-Ursnif-infected-host.exe (PID: 5956)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 5408)

    • Reads the software policy settings

      • slui.exe (PID: 1616)
      • slui.exe (PID: 5544)

    • Checks proxy server information

      • slui.exe (PID: 5544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:08:30 12:30:17+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 364544
InitializedDataSize: 304128
UninitializedDataSize: -
EntryPoint: 0x40db8
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 9.7.46.65
ProductVersionNumber: 9.7.46.65
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Noonlist PHT
ProductName: BlockFront
FileDescription: BlockFront
LegalCopyright: Copyright (c) 2001-2012, Noonlist PHT
OriginalFileName: On.exe
FileVersion: 9.7.46.65
InternalName: BlockFront
ProductVersion: 9.7.46.65
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
9
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2019-08-31-trickbot-gtag-leo10-retrieved-by-ursnif-infected-host.exe no specs sppextcomobj.exe no specs slui.exe CMSTPLUA 2019-08-31-trickbot-gtag-leo10-retrieved-by-ursnif-infected-host.exe no specs slui.exe #TRICKBOT svchost.exe 2019-08-31-vticmbqt-gtag-neq10-tettieved-by-wtupif-ipfected-hqut.exe no specs #TRICKBOT svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1128"C:\Users\admin\AppData\Roaming\MsCloud\2019-08-31-Vticmbqt-gtag-neq10-tettieved-by-Wtupif-ipfected-hqut.exe"C:\Users\admin\AppData\Roaming\MsCloud\2019-08-31-Vticmbqt-gtag-neq10-tettieved-by-Wtupif-ipfected-hqut.exe—svchost.exe
User:
SYSTEM
Company:
Noonlist PHT
Integrity Level:
SYSTEM
Description:
BlockFront
Exit code:
0
Version:
9.7.46.65
Modules
Images
c:\users\admin\appdata\roaming\mscloud\2019-08-31-vticmbqt-gtag-neq10-tettieved-by-wtupif-ipfected-hqut.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1616"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msxml6.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\ondemandconnroutehelper.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\webio.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winnsi.dll
3268C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
3304C:\WINDOWS\system32\svchost.exeC:\Windows\System32\svchost.exe
2019-08-31-Trickbot-gtag-leo10-retrieved-by-Ursnif-infected-host.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\userenv.dll
4040"C:\Users\admin\AppData\Local\Temp\2019-08-31-Trickbot-gtag-leo10-retrieved-by-Ursnif-infected-host.exe" C:\Users\admin\AppData\Local\Temp\2019-08-31-Trickbot-gtag-leo10-retrieved-by-Ursnif-infected-host.exe—dllhost.exe
User:
admin
Company:
Noonlist PHT
Integrity Level:
HIGH
Description:
BlockFront
Exit code:
0
Version:
9.7.46.65
Modules
Images
c:\users\admin\appdata\local\temp\2019-08-31-trickbot-gtag-leo10-retrieved-by-ursnif-infected-host.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5400C:\WINDOWS\system32\svchost.exeC:\Windows\System32\svchost.exe
2019-08-31-Vticmbqt-gtag-neq10-tettieved-by-Wtupif-ipfected-hqut.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\userenv.dll
5408C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
5544C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5956"C:\Users\admin\AppData\Local\Temp\2019-08-31-Trickbot-gtag-leo10-retrieved-by-Ursnif-infected-host.exe" C:\Users\admin\AppData\Local\Temp\2019-08-31-Trickbot-gtag-leo10-retrieved-by-Ursnif-infected-host.exe—explorer.exe
User:
admin
Company:
Noonlist PHT
Integrity Level:
MEDIUM
Description:
BlockFront
Exit code:
0
Version:
9.7.46.65
Modules
Images
c:\users\admin\appdata\local\temp\2019-08-31-trickbot-gtag-leo10-retrieved-by-ursnif-infected-host.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
14 049
Read events
14 049
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3304svchost.exeC:\Users\admin\AppData\Roaming\MsCloud\2019-08-31-Vticmbqt-gtag-neq10-tettieved-by-Wtupif-ipfected-hqut.exeexecutable
MD5:D747EFC26F7536467CD2F098E44E5362
SHA256:3E178CA9F660200D6452619F37D8864DA5289B1B0848C81280D2091235F0DECB
5400svchost.exeC:\Users\admin\AppData\Roaming\MsCloud\settings.initext
MD5:E0B25811371DCF6258A3B1528CF55879
SHA256:2CA8EE9C50D0BB0DDBB7AD5266BBBE3E7433351BA162200997CC91D58415808A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
39
DNS requests
14
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1616
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5544
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5400
svchost.exe
200.119.45.140:449
—
Colombia
CO
unknown
5400
svchost.exe
185.86.150.59:443
—
Sia Nano IT
LV
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted
dns.msftncsi.com
  • 131.107.255.255
whitelisted
self.events.data.microsoft.com
  • 20.189.173.28
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
  • 2a01:111:f100:9001::1761:914d
whitelisted
18.31.95.13.in-addr.arpa
  • —
unknown
d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-08-31-Trickbot-gtag-leo10-retrieved-by-Ursnif-infected-host.exe