File name:

2018-12-20-Ursnif-retrieved-by-Hancitor-infected-host.exe

Full analysis: https://app.any.run/tasks/ae63f24f-ff45-4682-a755-076c2d51dbfd
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 03:00:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

8A1495C8F27D36165E01CFA54468F34B

SHA1:

EF62F4C1CB28610E75664B53DDCCFCD0E80A6B9D

SHA256:

5061F35B959D1A36808515A9EF02FA92B54BD0448E38C5D9EEAB3A89D5C5E97A

SSDEEP:

3072:OH8zkfwmP3qVRDp/ziq5bAl5E63briHLbdlgbvEuLpsJRbQuaJd8FGnwkHLuaVVV:3g16VRDNzpAPiHfdovEupsJRbQuaJd8u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 7276)
      • iexplore.exe (PID: 6032)
      • iexplore.exe (PID: 7800)
      • iexplore.exe (PID: 856)
      • iexplore.exe (PID: 2644)
      • iexplore.exe (PID: 7280)
      • iexplore.exe (PID: 5352)
      • iexplore.exe (PID: 7312)
      • iexplore.exe (PID: 7952)
      • iexplore.exe (PID: 232)
      • iexplore.exe (PID: 4408)
      • iexplore.exe (PID: 1056)

    • Connects to the CnC server

      • iexplore.exe (PID: 7276)
      • iexplore.exe (PID: 6032)
      • iexplore.exe (PID: 7800)
      • iexplore.exe (PID: 856)
      • iexplore.exe (PID: 2644)
      • iexplore.exe (PID: 7280)
      • iexplore.exe (PID: 5352)
      • iexplore.exe (PID: 7952)
      • iexplore.exe (PID: 7312)
      • iexplore.exe (PID: 232)
      • iexplore.exe (PID: 4408)
      • iexplore.exe (PID: 1056)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 7276)
      • iexplore.exe (PID: 6032)
      • iexplore.exe (PID: 7800)
      • iexplore.exe (PID: 856)
      • iexplore.exe (PID: 2644)
      • iexplore.exe (PID: 7312)
      • iexplore.exe (PID: 7280)
      • iexplore.exe (PID: 5352)
      • iexplore.exe (PID: 7952)
      • iexplore.exe (PID: 232)
      • iexplore.exe (PID: 4408)
      • iexplore.exe (PID: 1056)

  • INFO

    • Checks supported languages

      • ielowutil.exe (PID: 7428)
      • 2018-12-20-Ursnif-retrieved-by-Hancitor-infected-host.exe (PID: 7504)

    • Reads the computer name

      • ielowutil.exe (PID: 7428)
      • 2018-12-20-Ursnif-retrieved-by-Hancitor-infected-host.exe (PID: 7504)

    • Reads the software policy settings

      • SIHClient.exe (PID: 6388)
      • slui.exe (PID: 7580)
      • slui.exe (PID: 6668)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 5428)

    • Checks proxy server information

      • slui.exe (PID: 6668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Clipper DOS Executable (2.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:12:25 07:08:01+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 97792
InitializedDataSize: 196096
UninitializedDataSize: -
EntryPoint: 0x12bf7
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 7.0.0.0
ProductVersionNumber: 3.0.0.0
FileFlagsMask: 0x004f
FileFlags: (none)
FileOS: Unknown (0x40534)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (457A)
CharacterSet: Unknown (A56B)
FileVersion: 2.6.3.51
InternalName: fapene.exe
LegalCopyright: Copyright (C) 2018, xuwih
ProductVersion: 2.6.3.51
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
170
Monitored processes
33
Malicious processes
18
Suspicious processes
5

Behavior graph

Click at the process to see the details
start 2018-12-20-ursnif-retrieved-by-hancitor-infected-host.exe sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe sihclient.exe iexplore.exe no specs #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
232"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7052 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
856"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4188 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1056"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6540 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1180"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2096"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2644"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1180 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3032"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3968"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4188"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
50 262
Read events
49 937
Write events
271
Delete events
54

Modification events

(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{5EED0EDB-0925-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
Executable files
0
Suspicious files
55
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6388SIHClient.exeC:\Windows\Logs\SIH\SIH.20250325.030112.877.1.etlbinary
MD5:999B96BE8AC7AB2116804F43A546878A
SHA256:EEC22CC441C29D19DC6BA632B4EB86DD353A9093BB0422C76CCA9B39BB42EE65
7276iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:96613C8A495B586795D17C145F79279C
SHA256:C8C247FED7E7FBAFB52999D82553C1BBF54DEA968BA75A30BBAB33F78707C175
7276iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
5428iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{5EED0EDD-0925-11F0-B4ED-18F7786F96EE}.datbinary
MD5:CB140CD1496FBDC6BF54E42EBFBB6D4F
SHA256:FFDD33B9F8955C2BAB284707048156AED72D1856F225C4BF8B008030183357D4
1180iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFC6B1352E42581A38.TMPbinary
MD5:7EB7C3317ED415963A183FF9EB5B2721
SHA256:A35D1FEE36741FD66E7D5B84A50811E0F5CDE4F7320AD5DD31A920BF186462AB
5428iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFA76B87A2CCD9F062.TMPbinary
MD5:455E1DFE1A0E57215CB3716BB644A861
SHA256:B42D42BCB25CE81F8C3E2F11FC6C571BA70BBC994D1103EAB7251221C71A6DCB
2096iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFF5008EBBC5942098.TMPbinary
MD5:1D8F08B952FE828F214B935B590CA663
SHA256:894B113ECE7A1A2CCF35BB4FF99DDF7A2544CE87C8BDD8F4E14E27A66DD1557D
5428iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF99FAED69F90BF1FA.TMPbinary
MD5:7BCC456AA335EF3ADA52984ABF6ED250
SHA256:C60A7634E8B6396E74AEFA2EAB723F76394FA735828A489A24B1003895A8BA49
8136iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{84EFF591-0925-11F0-B4ED-18F7786F96EE}.datbinary
MD5:BD99B80100B63C304DDBCE5D90B0263A
SHA256:A2CF4FC57982ECEA6F2CE56BD03FBA5BADF139329529F57EC6D132A3061EA74C
2096iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF8B1A31F3F0C0408D.TMPbinary
MD5:6723C50A832D605A14FD6B6AC6ABA7EA
SHA256:CC8BE0D777710352467D5D0938094351B64BBFE18D79B50962E983FAB44FCC6B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
90
DNS requests
35
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7276
iexplore.exe
GET
404
49.13.77.253:80
http://api2.doter.at/webstore/pKPdYk3WTG2wE/SQYG2eJT/t9mKLMs4m2lgqVpomc0j0S1/tpaExdRH7n/ZVBZelb6qB2FV_2Bm/OMA6FiSU9Eyl/RHuSU04yMZv/CUTYwyytYSBG87/08gF7XfMFEqIuKn3PnBtZ/WPOzJ9_2FWfc1pJO/p3Eigtm28NEp4Hp/j5_2F7E0UOSyfQpxSL/_2FKAscwy/MgqcigvxWbigG8qUKF6r/6FQ8CzUiHv/vJNof
unknown
—
—
malicious
6032
iexplore.exe
GET
404
49.13.77.253:80
http://in.extermas.at/webstore/aunqSk6C/kvuM6JhswKiev5NKzzwlR8T/621jJ6Hb6P/ivJWIzsjGR3lF4ZtF/QIlO37B5OZ23/X2eLHWwF5uL/aDUzY8vJP8OscB/QkaVDG8iYtfF71bAdRmXo/rHyAy7s2qgOk75CB/c5jVJD5PLQrRRMD/CvYcPCrVZgW0nUWG_2/FQ_2FggSl/h_2BHTYHMdAxZhexAxga/jt0SP6DRQ2tABFTZrH2/tRhsNXq1gDYqhwgIerVeFr/ePWo_2BT
unknown
—
—
malicious
7800
iexplore.exe
GET
404
49.13.77.253:80
http://ax.zaravid.at/webstore/lPsJLiZgNrp7X0JQgqQTLTG/lrLE2rucJm/xSno0ZOddGyDoGPTz/p8kkA333jT5J/Rxs_2BUo4rV/KtbZiXvdCZ3bYj/4pmtLYKosJo0dr1g0i_2B/aWu_2FBWW5A9HTpQ/o_2BLHSHkMC2XWv/PZIv8djAgiwPv4sd9_/2Bv57u_2B/C6pDDYR_2FI65LqiakcQ/9ZkQYDVR6h3k2Qp7G_2/FzGP19RhsR7aGRfT8ZhYun/IZu
unknown
—
—
malicious
2644
iexplore.exe
GET
404
49.13.77.253:80
http://gif.doter.at/webstore/9w9ViefSud0MvWnn9XIrM/9Z8OXeiKMTLkK3X7/Wu47gzhSgmxIqSl/AnEoljy4gxp4XJeot7/jv1qtGY4F/AufuNUSbQquHumtsVEom/rDGEl73VdvUn68727Xh/RMRBo54gZ_2BGJzlQ5IRKr/XVgkqyw2T0NzR/usz6BJQ2/1mzjT91y8O5Z6FHrdhWSX99/cBUviqXb1Q/B_2BP7G_2FvYoRkLM/8GvZxdJkPas0/EPArawq0iP5srByx2/V
unknown
—
—
malicious
856
iexplore.exe
GET
404
49.13.77.253:80
http://g2.ex100p.at/webstore/PwY0ldYGsM7dRrxpO0EHgAi/yNHdktGEtK/4SqU9SM_2B_2FbofH/F3i2SEdwYB09/JdjPK6omBOY/BP2a4WNZ08Gysb/nVMSLMXFMPPa8wyCjEzig/1AirPLiPTMNwJ4JI/mtIO2Zx1LzR7X14/wimghu6XC5XQNhdske/9Z_2F4mMI/_2BV97sWszNXBYvtE_2F/9Yc09Ax40oPiCSKfK_2/FqZfh9quvPxch8nH/Yia1I
unknown
—
—
malicious
7280
iexplore.exe
GET
404
49.13.77.253:80
http://extra.avareg.cn/webstore/LGVI6KIeo4/R5woaiQsA3rCjzPv_/2B9lRXLJDBML/olekl28urK9/9S9ZXx3zE2ZTOM/xoalJX2kJ1rA3EM1NVYdY/px4bdJoFve15ItlW/y680PiTJQ8kkOIN/ACjpUk_2BFt_2Flbty/MmB_2BVMz/4pIj9PuftddKMZX3fFYC/j_2BFolBtwwtEBNp2LF/gQyxMJNjWAqVvslcDfVdTj/o_2FtH2bOqUOO/hqiUiQ2m/5iTjerFRFwUNm3Isc/ag63W
unknown
—
—
malicious
5624
iexplore.exe
GET
404
49.13.77.253:80
http://foo.avaregio.at/webstore/uL7QsAzI75UjNkm4t52l/paAwvbPxhfe4lJO7T9a/N_2FFH8Atz2mJiwg05IMSF/Wb7oZWvFWbOiy/ekayE_2B/mJBZ3pIneDPUbr2oUjG46mt/H99l9KEIwE/0j7d4DiY71F6uk5EM/jOsON7vHy1xn/BGrXFdOp0kj/3hri1VsOVW0j_2/BpXYMVCjl67bWgdZQ0SNS/kYD_2FxeeB62Zvjp/NCmC3Hy8wYtv5ol/f
unknown
—
—
unknown
5352
iexplore.exe
GET
404
49.13.77.253:80
http://op.iovbased.at/webstore/C1BXOEVZREBk1qmiKieXo/LHiG65TNNZlemkAJ/9KS_2BkUnQJB8gk/5SSJdaEE7TpEgMLZUn/5RBmDh6Ab/Tg4EV_2FZWDpuyJ5h10F/rtan_2Ff_2BFgJLDJW4/pDBv41IpQJbMNt9thnXwde/s7yr7BQ21LJ0R/rACOZpqK/wo0kR74xkhZsifFrV3C5f8k/ivc_2BU3qv/Xlih8oeKDiowVt1pQ/q51GhhqkfX82/vZS8C_2F5To/gVFO9aV5/6yjgC
unknown
—
—
malicious
7312
iexplore.exe
GET
404
49.13.77.253:80
http://f1.cnboal.at/webstore/0w_2FfNCeG6/3AQ5b748PjxWaw/VVSghgwl_2FsNbl_2FcT9/uLeDeqAFlYTn8QUd/eqQG_2BWJEm3OCY/0Q3aopNMRRS30CqBUM/XahcGk9Zu/MzXsApgQwLVE5EC3qCg5/WVcSTfgWu8ovAirkIaP/CDI_2F2rFatjXaQoSF0ssO/X3D0c2tcLKwbp/LhdkuJjP/bNl7iT5pvC9zG_2FBHaEL9k/34jkKhvaEi/dKb3WHkvcq9dIUyfT/4vCWZ7wP/pIM
unknown
—
—
malicious
7952
iexplore.exe
GET
404
49.13.77.253:80
http://ws.doter.at/webstore/2FzoD_2FLwu1/sD_2F1Zx7SF/b6y8pmUGj0GktY/d5TDO_2FidigEZGe2MbUO/9o_2FfrOwZ2o2BK_/2F6wv15z9MtUN0W/mB3drlm0PRdLwpfUak/mmDwghVIl/F7A5IvDCAdO0ajDKUwwJ/_2BAlNpeoEhnDb7ne9i/5EMDt2_2FHlp6GkLLhbHPK/zo_2BqmSc40xZ/UZLQ_2Bs/KC_2F9mWiN_2FBxLzNbHtve/_2Fr6Rx6ybGnrcNC/L
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7732
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.68
  • 40.126.31.128
  • 20.190.159.73
  • 20.190.159.23
  • 20.190.159.64
  • 20.190.159.71
  • 40.126.31.71
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.74.47.205
whitelisted
api2.doter.at
  • 49.13.77.253
malicious
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
  • 2603:1030:800:5::bfee:a08d
whitelisted
241.42.69.40.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
7276
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
7504
2018-12-20-Ursnif-retrieved-by-Hancitor-infected-host.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
6032
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
7800
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
856
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
856
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2644
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
7280
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5352
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5352
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2018-12-20-Ursnif-retrieved-by-Hancitor-infected-host.exe