File name:

2019-01-22-Ursnif-retreived-by-Hancitor-infected-host.exe

Full analysis: https://app.any.run/tasks/3240cda5-f6f7-443b-96c4-b985733f62b7
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 03:11:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

5D966240FC9B6E84124555A4A595D34D

SHA1:

379EEBBA5C06456953C04AECF12E777AFFA78638

SHA256:

4EF443DC917DE8B83F54787D666F46AAC66DEFD75D03446678E0900B214E5D2D

SSDEEP:

3072:2684jp17XReZVGABu/bmmfSRgNFpo/0FdZGqWL5ypI8jf8fL9XzVTW8h:L7Xotobd6SNvoO7vcyaFT9X5D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 6988)
      • iexplore.exe (PID: 300)
      • iexplore.exe (PID: 6940)
      • iexplore.exe (PID: 3768)
      • iexplore.exe (PID: 1328)
      • iexplore.exe (PID: 4724)
      • iexplore.exe (PID: 976)
      • iexplore.exe (PID: 6540)
      • iexplore.exe (PID: 4172)
      • iexplore.exe (PID: 5608)
      • iexplore.exe (PID: 1012)
      • iexplore.exe (PID: 6244)

    • Connects to the CnC server

      • iexplore.exe (PID: 6988)
      • iexplore.exe (PID: 300)
      • iexplore.exe (PID: 6940)
      • iexplore.exe (PID: 3768)
      • iexplore.exe (PID: 976)
      • iexplore.exe (PID: 1328)
      • iexplore.exe (PID: 5608)
      • iexplore.exe (PID: 6540)
      • iexplore.exe (PID: 4172)
      • iexplore.exe (PID: 1012)
      • iexplore.exe (PID: 4724)
      • iexplore.exe (PID: 6244)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 6988)
      • iexplore.exe (PID: 300)
      • iexplore.exe (PID: 6940)
      • iexplore.exe (PID: 3768)
      • iexplore.exe (PID: 1328)
      • iexplore.exe (PID: 976)
      • iexplore.exe (PID: 4172)
      • iexplore.exe (PID: 6540)
      • iexplore.exe (PID: 5608)
      • iexplore.exe (PID: 6244)
      • iexplore.exe (PID: 1012)
      • iexplore.exe (PID: 4724)

  • INFO

    • Reads the computer name

      • ielowutil.exe (PID: 7084)
      • 2019-01-22-Ursnif-retreived-by-Hancitor-infected-host.exe (PID: 6480)

    • Checks supported languages

      • 2019-01-22-Ursnif-retreived-by-Hancitor-infected-host.exe (PID: 6480)
      • ielowutil.exe (PID: 7084)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 5936)

    • Reads the software policy settings

      • slui.exe (PID: 6808)
      • slui.exe (PID: 6108)

    • Checks proxy server information

      • slui.exe (PID: 6108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (64.2)
.dll | Win32 Dynamic Link Library (generic) (15.6)
.exe | Win32 Executable (generic) (10.6)
.exe | Generic Win/DOS Executable (4.7)
.exe | DOS Executable Generic (4.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:07:31 12:43:47+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 126976
InitializedDataSize: 28672
UninitializedDataSize: 184320
EntryPoint: 0x4c180
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x004f
FileFlags: (none)
FileOS: Unknown (0x40534)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (457A)
CharacterSet: Unknown (A56B)
FileVersion: 4.2.8.15
InternalName: zemexer.exe
LegalCopyright: Copyright (C) 2018, tedakedaza
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
29
Malicious processes
16
Suspicious processes
6

Behavior graph

Click at the process to see the details
start 2019-01-22-ursnif-retreived-by-hancitor-infected-host.exe sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:536 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
536"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
736"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
976"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6136 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1012"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3900 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1328"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2896"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2980C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3620"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3768"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6660 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
43 949
Read events
43 658
Write events
241
Delete events
50

Modification events

(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{F5EDEECB-0926-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(5936) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
Executable files
0
Suspicious files
50
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
536iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF0A878E53AC436008.TMPbinary
MD5:0722F597B182AACF7DD40AAB27D49F03
SHA256:51E5A204C74235C36E87DDDA1EEF1A72FC0A08F76DC3B93103E6CECAC1ECBAD1
6988iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
5936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{F5EDEECD-0926-11F0-B4ED-18F7786F96EE}.datbinary
MD5:F79EAF3F767F572621DAA313D38E7015
SHA256:634F1F8168AF3878EBFCA0310AF26A795F4A4CB260BDE0AE18FD92CF13AD18D4
4428iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFE047B5C4730670E8.TMPbinary
MD5:C4F486FD32233A66B5C6AA7139142C7A
SHA256:E445A5D9A99D78CB27D2756377B12295D1371F283007C6931F3D309495B92C13
536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{0F3843F9-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:4484B72F88F7C4BB708B7F1AB12531D7
SHA256:0859C2D0FAB73C665906E493CF1F70CBEDE6E379C1296A3CBEC1AFA79971FF2A
5936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{F5EDEECB-0926-11F0-B4ED-18F7786F96EE}.datbinary
MD5:75D82E525ACACD470366316792BBAF98
SHA256:9C4EB2D54170AD9AD1B45F379169F6AF8FE0699541A27EE58806FDCA55F474B8
5936iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF1994AF30D8663A19.TMPbinary
MD5:6C9480EC3B4013DB2E1D13DC16B9D56B
SHA256:D52C001950CC860036F561AD786334FCA817798B38A427711610C2295E4602B1
536iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF0660F21EF605F505.TMPbinary
MD5:E60980DBE9527BD12CB1C94B6532BB78
SHA256:87BBFB72426FC1D0B6C2B0E0476483B47E9C42FE027A685D902D9C152FBC2D88
5936iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFB660774BFFDFE882.TMPbinary
MD5:96D95DFD84BD4778EA5F0C35501CDD80
SHA256:65317849E9714772F0C8EDD3D765C7BD68FCF687FD41BD66FE4FC645D1BECDC2
536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{0F3843F7-0927-11F0-B4ED-18F7786F96EE}.datbinary
MD5:C8307643D1DF756A4034F0A6D92CB99A
SHA256:2C4981007E33DC68EE73ECF711708028D1E00E98C21A0EF3E0BC201A45569243
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
90
DNS requests
36
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6988
iexplore.exe
GET
404
49.13.77.253:80
http://g2.ex100p.at/webstore/2AtND5NzV/fbIzad2A2q6k_2FUvuvo/xHwoGRsn_2FytA31ukj/NTG558VNDTtOW9d_2BJmZG/WjClyQNHegZnH/wGrk2PjL/6pLXSI3_2Fwjjlqo55X7IHh/FxsOuAiWlc/Hw7M0jQSn95YOfgVy/JKP8DIL4RAgW/a3C6VaBTBk2/2efnQwfCIrfKeC/bSNfZ_2Bus_2FybwBfxzv/lbbQeuQ5HXgEQ0el/RwYLDXtk/3pN
unknown
—
—
malicious
6940
iexplore.exe
GET
404
49.13.77.253:80
http://ax.ikobut.at/webstore/f_2F0P1rF_2F9D_/2FurWz25aXQBsIwl5O/IOlNhIMII/GnXrHLq3BGQXMuz2LRiB/ORxaFZS5svMTQctw_2F/wqBOXomZtvWyECch_2BpAC/pgoUlRoWMgoyg/xhFty04r/fYi_2BqZtcfoe05nG3R_2Bs/yTJoqzs7OP/Xpz3iPidtcoRZsv6W/8wciqMz4ckpi/duBawgRUkuJ/ZJmOTrc4GkOb2B/8wx_2FysxTU5u2rHLu/r
unknown
—
—
malicious
300
iexplore.exe
GET
404
49.13.77.253:80
http://in.termas.at/webstore/5lZ_2F6sTRi2iw5v_2/B3Nky_2FG/iV0ULG0oNpKK9PJDFIMT/egs76eOkKRDmUcttNU_/2BIRd1iTmPJwYjgLLPBzf1/kSOFAqYLj5oQK/0yyE_2BN/_2BAEYPJLPLeS2qRw7ozsWr/4OqkHOLBnU/CMWNm6BIQCBCmJx7F/yf1Mrk0lfMts/7R3_2BjmSu9/0t2c9eyxDPGLQR/xhCp1Me97rbozlULLuw_2/BULapGSG/t3fRN
unknown
—
—
malicious
3768
iexplore.exe
GET
404
49.13.77.253:80
http://sm.dvloop.at/webstore/hgQVd_2BJp/wzIfsGKRVLzU_2FsK/pyE5fetkLVu9/kdUftwAulwT/0ge3JEUls2Fq18/30PEqauho7zLG_2BEEN70/24VoQ_2FoFB_2BC1/eAXCLD_2FmOezHP/HtVX9XZ1IoFoYyalWT/a_2BBYEGJ/XTIU79katoUI6TI0YRLY/hcGAGJ29HbQulPp879e/Ct4lp6UNBNXlzKjVU76js6/dJhTl_2BNqLd0/objTXMdpO/jiVe
unknown
—
—
malicious
1328
iexplore.exe
GET
404
49.13.77.253:80
http://extra.avareg.cn/webstore/0Ngf_2BmBcis4IVIHa_2F/ebc6N_2BSlmG0PTI/XiiMQSAYJlugkGT/0RU_2FYBIeh4XyaMbY/5zyDQdKBg/ewJVJ8fQD5cYuTS3Qt8l/dLeXs7rxXrhYTBoi6Ym/KyOJg_2FIiV5h4hHyjIrbh/_2FcnBa_2FYZu/rD3BUudI/QT0pdo_2BbYXI3U1y_2FNOs/LFPLaoO0Wf/ZTPHvJ4UMWUKJZZbV/VdxjoO8Doc_2/F4UP840dK_2/Fh_2BAJat3l4Eu/4gCEKUpjM/fV
unknown
—
—
malicious
976
iexplore.exe
GET
404
49.13.77.253:80
http://api.ex100p.at/webstore/F21Kf3TiSXRtKMxJJXlzYx5/2rM1Rd7G17/5MJt2aBMG_2Foyc1W/DPmjyb6G2PMt/wVR7MFPQZVa/TcM5s7sH2tie6t/K2FmWkYMulx3s0YFtC_2B/MDdZlu1nqllPN1_2/BppuRCyx_2F1MnK/6_2BPwDoqCD2YG0CoI/WA9uIas4i/QlDC_2BuqETD2SXeif_2/FmkllHWqtBNPs_2BmcO/Oxye59F7kOa9miOGva_2B4/ThLDz
unknown
—
—
malicious
6540
iexplore.exe
GET
404
49.13.77.253:80
http://foo.avaregio.at/webstore/2EcllJZroI3KUoB_2Fhnwhv/qBf8iX1NMy/mST1lohm_2FzmCxPR/vjHRiWiJbl0y/SVvdfbGZJdO/TCJua5qrbr_2Fa/UwvqBVUAMEETSlUmZYpJ4/DD1Ci2zXEy0euTAk/Htk1NY8qfwSHCKA/ZXKAy9DXyxZMY_2BjC/MN_2Bc9Zs/7DLbSwqLhYZyiNgoAPx5/S1itnM4_2BqKfoHqb6H/x2pC2fz8f_2F5BhHO_2BpV/xUaAaIsGGQrlt/cfvzPszV/y9j
unknown
—
—
malicious
4172
iexplore.exe
GET
404
49.13.77.253:80
http://op.basedok.at/webstore/9m4PV53mE90JI23K7RRYL_/2Bus7LcY1i_2F/JqTvUcQS/cekKt0gO3pmyJY8DTkwSbZk/GH1Nw6Uz6D/S_2FYipBSgPg_2Fvd/s4q6ZxWeEIcu/IFXmkNpXxW8/J6XSKeylXM_2Bg/KVEUtH39ahQHJ9pIM4AAj/fQpmnpeJqnQitdWf/_2FBPijYwtlJUAQ/cO76L5LLaU6MC15ADm/DQ7Hx6bfY/FrMAAPACip_2B2/bQwUr
unknown
—
—
malicious
5608
iexplore.exe
GET
404
49.13.77.253:80
http://f1.cnboal.at/webstore/jHEAUNUGF7ABwOaMulO/e92FzXNX9mKht0rSbuUblx/OCmpV0HqHsFsF/JuVZz2rM/ojYrJwLi5ksOyRdR30tP9n6/HNOhH3aSic/c_2BYuuhaQA1sz7dg/GiG9DLAIibTm/wGaAUzK5rxU/_2FzTYUme9C1L8/Wn6LQqx_2BTnudpuLHepZ/EmA4TVPFqsfq4n0O/AA5_2FBzKP4eAj2/MT8AbNygb58W/ZM_2Bsq3/Yp6
unknown
—
—
malicious
1012
iexplore.exe
GET
404
49.13.77.253:80
http://pop.muongo.at/webstore/XkHRkcPZ_2BxH_2B3nuxrtt/FpFVwKQqCK/VmXCM_2FLuvCXRy_2/F6Jj5cPCVUw8/SbA297KQ1Wu/6pAnG_2BIMSjio/1ZTytzmZTLIV7ttd46oAD/xlImwmARdYn_2Fuo/BirEq0dPDTMNOc9/MLT_2BztXjVuHQQP_2/FMB0DzZlp/6iNPocEr4L8I5WzjVI8S/hGrGHnTZY6bPevZhCZS/aqQb9gbAWGsL38dm8eUj_2/BPL4_2B
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6988
iexplore.exe
49.13.77.253:80
g2.ex100p.at
Hetzner Online GmbH
DE
malicious
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.238
whitelisted
g2.ex100p.at
  • 49.13.77.253
malicious
client.wns.windows.com
  • 40.113.103.199
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.66
  • 20.190.160.2
  • 20.190.160.3
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.128
  • 20.190.160.130
  • 40.126.32.140
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
beetfeetlife.bit
  • 49.13.77.253
unknown
iecvlist.microsoft.com
  • 52.239.160.33
whitelisted
c.urs.microsoft.com
  • 20.82.9.214
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

PID
Process
Class
Message
6988
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6988
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
6480
2019-01-22-Ursnif-retreived-by-Hancitor-infected-host.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
300
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6940
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6940
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
3768
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
3768
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
1328
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
1328
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-01-22-Ursnif-retreived-by-Hancitor-infected-host.exe