File name:

2019-01-22-Ursnif-retreived-by-Hancitor-infected-host.exe

Full analysis: https://app.any.run/tasks/3240cda5-f6f7-443b-96c4-b985733f62b7
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 03:11:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

5D966240FC9B6E84124555A4A595D34D

SHA1:

379EEBBA5C06456953C04AECF12E777AFFA78638

SHA256:

4EF443DC917DE8B83F54787D666F46AAC66DEFD75D03446678E0900B214E5D2D

SSDEEP:

3072:2684jp17XReZVGABu/bmmfSRgNFpo/0FdZGqWL5ypI8jf8fL9XzVTW8h:L7Xotobd6SNvoO7vcyaFT9X5D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 6988)
      • iexplore.exe (PID: 300)
      • iexplore.exe (PID: 6940)
      • iexplore.exe (PID: 3768)
      • iexplore.exe (PID: 976)
      • iexplore.exe (PID: 6540)
      • iexplore.exe (PID: 4172)
      • iexplore.exe (PID: 5608)
      • iexplore.exe (PID: 4724)
      • iexplore.exe (PID: 1328)
      • iexplore.exe (PID: 1012)
      • iexplore.exe (PID: 6244)

    • Connects to the CnC server

      • iexplore.exe (PID: 6988)
      • iexplore.exe (PID: 300)
      • iexplore.exe (PID: 6940)
      • iexplore.exe (PID: 3768)
      • iexplore.exe (PID: 4172)
      • iexplore.exe (PID: 1328)
      • iexplore.exe (PID: 976)
      • iexplore.exe (PID: 6540)
      • iexplore.exe (PID: 5608)
      • iexplore.exe (PID: 1012)
      • iexplore.exe (PID: 4724)
      • iexplore.exe (PID: 6244)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 6988)
      • iexplore.exe (PID: 300)
      • iexplore.exe (PID: 6940)
      • iexplore.exe (PID: 3768)
      • iexplore.exe (PID: 1328)
      • iexplore.exe (PID: 976)
      • iexplore.exe (PID: 6540)
      • iexplore.exe (PID: 5608)
      • iexplore.exe (PID: 4172)
      • iexplore.exe (PID: 1012)
      • iexplore.exe (PID: 4724)
      • iexplore.exe (PID: 6244)

  • INFO

    • Checks supported languages

      • ielowutil.exe (PID: 7084)
      • 2019-01-22-Ursnif-retreived-by-Hancitor-infected-host.exe (PID: 6480)

    • Reads the computer name

      • 2019-01-22-Ursnif-retreived-by-Hancitor-infected-host.exe (PID: 6480)
      • ielowutil.exe (PID: 7084)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 5936)

    • Reads the software policy settings

      • slui.exe (PID: 6808)
      • slui.exe (PID: 6108)

    • Checks proxy server information

      • slui.exe (PID: 6108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (64.2)
.dll | Win32 Dynamic Link Library (generic) (15.6)
.exe | Win32 Executable (generic) (10.6)
.exe | Generic Win/DOS Executable (4.7)
.exe | DOS Executable Generic (4.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:07:31 12:43:47+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 126976
InitializedDataSize: 28672
UninitializedDataSize: 184320
EntryPoint: 0x4c180
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x004f
FileFlags: (none)
FileOS: Unknown (0x40534)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (457A)
CharacterSet: Unknown (A56B)
FileVersion: 4.2.8.15
InternalName: zemexer.exe
LegalCopyright: Copyright (C) 2018, tedakedaza
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
29
Malicious processes
16
Suspicious processes
6

Behavior graph

Click at the process to see the details
start 2019-01-22-ursnif-retreived-by-hancitor-infected-host.exe sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:536 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
536"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
736"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
976"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6136 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1012"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3900 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1328"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2896"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2980C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3620"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3768"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6660 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
43 949
Read events
43 658
Write events
241
Delete events
50

Modification events

(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{F5EDEECB-0926-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
Executable files
0
Suspicious files
50
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{F5EDEECD-0926-11F0-B4ED-18F7786F96EE}.datbinary
MD5:F79EAF3F767F572621DAA313D38E7015
SHA256:634F1F8168AF3878EBFCA0310AF26A795F4A4CB260BDE0AE18FD92CF13AD18D4
5936iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFB660774BFFDFE882.TMPbinary
MD5:96D95DFD84BD4778EA5F0C35501CDD80
SHA256:65317849E9714772F0C8EDD3D765C7BD68FCF687FD41BD66FE4FC645D1BECDC2
6660iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFC48DC13F1D5E6476.TMPbinary
MD5:F4256CDA1889E2ABBC76E8FF5F4239EA
SHA256:2595889B001C436B3458E296FDFD76D281F7396F19B51793366F7C5DF6E46D27
4428iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{1C38A0EF-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:0395A3E5F6C1683C4AC524E82C8E5FEE
SHA256:E388F5638B86F941096A84A8439F5534FEB590069E4173F6B1FB7963FCA3F8A5
536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{0F3843F7-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:C8307643D1DF756A4034F0A6D92CB99A
SHA256:2C4981007E33DC68EE73ECF711708028D1E00E98C21A0EF3E0BC201A45569243
536iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF0A878E53AC436008.TMPbinary
MD5:0722F597B182AACF7DD40AAB27D49F03
SHA256:51E5A204C74235C36E87DDDA1EEF1A72FC0A08F76DC3B93103E6CECAC1ECBAD1
2896iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFC372EF172A524BBF.TMPbinary
MD5:54642F152820B83B8247A15C1F173D26
SHA256:E2AE9BC38790C538406EDCE4152C8DEB5E6714806C27FFB747DA1FD3439F9244
4428iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF1A756C14BBF17D45.TMPbinary
MD5:99356159782628102C8DADB326698924
SHA256:F00A1A5BDF88F330D7965A44CA42AEB29381D008FB40C5D96C7622AD3C2D1AD9
6660iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{2931C601-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:1BA5C7D761B5989D4BCF39E4612FCCD6
SHA256:BE3AAB57FA4888E7B6A4ABB94F2CB0EEA170E037729A4C5D29E10944ACFD98F1
2896iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{36309FAB-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:F46B8B45844A5C12463E1A32D2C586BA
SHA256:4B70F9FA8AD895638864FE0D0A0A8BE4A16B6850CEDCEB48CB0414902327FDA1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
90
DNS requests
36
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
300
iexplore.exe
GET
404
49.13.77.253:80
http://in.termas.at/webstore/5lZ_2F6sTRi2iw5v_2/B3Nky_2FG/iV0ULG0oNpKK9PJDFIMT/egs76eOkKRDmUcttNU_/2BIRd1iTmPJwYjgLLPBzf1/kSOFAqYLj5oQK/0yyE_2BN/_2BAEYPJLPLeS2qRw7ozsWr/4OqkHOLBnU/CMWNm6BIQCBCmJx7F/yf1Mrk0lfMts/7R3_2BjmSu9/0t2c9eyxDPGLQR/xhCp1Me97rbozlULLuw_2/BULapGSG/t3fRN
unknown
—
—
malicious
6940
iexplore.exe
GET
404
49.13.77.253:80
http://ax.ikobut.at/webstore/f_2F0P1rF_2F9D_/2FurWz25aXQBsIwl5O/IOlNhIMII/GnXrHLq3BGQXMuz2LRiB/ORxaFZS5svMTQctw_2F/wqBOXomZtvWyECch_2BpAC/pgoUlRoWMgoyg/xhFty04r/fYi_2BqZtcfoe05nG3R_2Bs/yTJoqzs7OP/Xpz3iPidtcoRZsv6W/8wciqMz4ckpi/duBawgRUkuJ/ZJmOTrc4GkOb2B/8wx_2FysxTU5u2rHLu/r
unknown
—
—
malicious
6988
iexplore.exe
GET
404
49.13.77.253:80
http://g2.ex100p.at/webstore/2AtND5NzV/fbIzad2A2q6k_2FUvuvo/xHwoGRsn_2FytA31ukj/NTG558VNDTtOW9d_2BJmZG/WjClyQNHegZnH/wGrk2PjL/6pLXSI3_2Fwjjlqo55X7IHh/FxsOuAiWlc/Hw7M0jQSn95YOfgVy/JKP8DIL4RAgW/a3C6VaBTBk2/2efnQwfCIrfKeC/bSNfZ_2Bus_2FybwBfxzv/lbbQeuQ5HXgEQ0el/RwYLDXtk/3pN
unknown
—
—
malicious
3768
iexplore.exe
GET
404
49.13.77.253:80
http://sm.dvloop.at/webstore/hgQVd_2BJp/wzIfsGKRVLzU_2FsK/pyE5fetkLVu9/kdUftwAulwT/0ge3JEUls2Fq18/30PEqauho7zLG_2BEEN70/24VoQ_2FoFB_2BC1/eAXCLD_2FmOezHP/HtVX9XZ1IoFoYyalWT/a_2BBYEGJ/XTIU79katoUI6TI0YRLY/hcGAGJ29HbQulPp879e/Ct4lp6UNBNXlzKjVU76js6/dJhTl_2BNqLd0/objTXMdpO/jiVe
unknown
—
—
malicious
6540
iexplore.exe
GET
404
49.13.77.253:80
http://foo.avaregio.at/webstore/2EcllJZroI3KUoB_2Fhnwhv/qBf8iX1NMy/mST1lohm_2FzmCxPR/vjHRiWiJbl0y/SVvdfbGZJdO/TCJua5qrbr_2Fa/UwvqBVUAMEETSlUmZYpJ4/DD1Ci2zXEy0euTAk/Htk1NY8qfwSHCKA/ZXKAy9DXyxZMY_2BjC/MN_2Bc9Zs/7DLbSwqLhYZyiNgoAPx5/S1itnM4_2BqKfoHqb6H/x2pC2fz8f_2F5BhHO_2BpV/xUaAaIsGGQrlt/cfvzPszV/y9j
unknown
—
—
malicious
1328
iexplore.exe
GET
404
49.13.77.253:80
http://extra.avareg.cn/webstore/0Ngf_2BmBcis4IVIHa_2F/ebc6N_2BSlmG0PTI/XiiMQSAYJlugkGT/0RU_2FYBIeh4XyaMbY/5zyDQdKBg/ewJVJ8fQD5cYuTS3Qt8l/dLeXs7rxXrhYTBoi6Ym/KyOJg_2FIiV5h4hHyjIrbh/_2FcnBa_2FYZu/rD3BUudI/QT0pdo_2BbYXI3U1y_2FNOs/LFPLaoO0Wf/ZTPHvJ4UMWUKJZZbV/VdxjoO8Doc_2/F4UP840dK_2/Fh_2BAJat3l4Eu/4gCEKUpjM/fV
unknown
—
—
malicious
976
iexplore.exe
GET
404
49.13.77.253:80
http://api.ex100p.at/webstore/F21Kf3TiSXRtKMxJJXlzYx5/2rM1Rd7G17/5MJt2aBMG_2Foyc1W/DPmjyb6G2PMt/wVR7MFPQZVa/TcM5s7sH2tie6t/K2FmWkYMulx3s0YFtC_2B/MDdZlu1nqllPN1_2/BppuRCyx_2F1MnK/6_2BPwDoqCD2YG0CoI/WA9uIas4i/QlDC_2BuqETD2SXeif_2/FmkllHWqtBNPs_2BmcO/Oxye59F7kOa9miOGva_2B4/ThLDz
unknown
—
—
malicious
5608
iexplore.exe
GET
404
49.13.77.253:80
http://f1.cnboal.at/webstore/jHEAUNUGF7ABwOaMulO/e92FzXNX9mKht0rSbuUblx/OCmpV0HqHsFsF/JuVZz2rM/ojYrJwLi5ksOyRdR30tP9n6/HNOhH3aSic/c_2BYuuhaQA1sz7dg/GiG9DLAIibTm/wGaAUzK5rxU/_2FzTYUme9C1L8/Wn6LQqx_2BTnudpuLHepZ/EmA4TVPFqsfq4n0O/AA5_2FBzKP4eAj2/MT8AbNygb58W/ZM_2Bsq3/Yp6
unknown
—
—
malicious
4172
iexplore.exe
GET
404
49.13.77.253:80
http://op.basedok.at/webstore/9m4PV53mE90JI23K7RRYL_/2Bus7LcY1i_2F/JqTvUcQS/cekKt0gO3pmyJY8DTkwSbZk/GH1Nw6Uz6D/S_2FYipBSgPg_2Fvd/s4q6ZxWeEIcu/IFXmkNpXxW8/J6XSKeylXM_2Bg/KVEUtH39ahQHJ9pIM4AAj/fQpmnpeJqnQitdWf/_2FBPijYwtlJUAQ/cO76L5LLaU6MC15ADm/DQ7Hx6bfY/FrMAAPACip_2B2/bQwUr
unknown
—
—
malicious
4724
iexplore.exe
GET
404
49.13.77.253:80
http://xxx.lapoder.at/webstore/_2FDPCzNy/ZlhVxL8VCMCG19n38nbr/Zvv1Hqie3a4jfhgHd6U/vPBtzFzEbwpLbmO6u_2F9U/_2FTwB3ukDI_2/B5ps3fp7/8Jnh8uhtQCaXrH5y37TVkye/EQ620k2IgZ/ZNUo4a0TJkXQsEx3H/iuhmbgpjissC/OZszhlxbU4E/B6_2FqYoa60xqc/ERGALQBqR8EdkVxtTH5EV/3BJqvajVf_2Biwph/DNeik39Uz4Dl4bn/TJMJVRCAKv/7p0jY8s
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6988
iexplore.exe
49.13.77.253:80
g2.ex100p.at
Hetzner Online GmbH
DE
malicious
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.238
whitelisted
g2.ex100p.at
  • 49.13.77.253
malicious
client.wns.windows.com
  • 40.113.103.199
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.66
  • 20.190.160.2
  • 20.190.160.3
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.128
  • 20.190.160.130
  • 40.126.32.140
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
beetfeetlife.bit
  • 49.13.77.253
unknown
iecvlist.microsoft.com
  • 52.239.160.33
whitelisted
c.urs.microsoft.com
  • 20.82.9.214
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

PID
Process
Class
Message
6988
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6988
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
6480
2019-01-22-Ursnif-retreived-by-Hancitor-infected-host.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
300
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6940
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6940
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
3768
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
3768
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
1328
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
1328
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-01-22-Ursnif-retreived-by-Hancitor-infected-host.exe