File name:

2018-12-20-Ursnif-retrieved-by-Hancitor-infected-host.exe

Full analysis: https://app.any.run/tasks/ae63f24f-ff45-4682-a755-076c2d51dbfd
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 03:00:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

8A1495C8F27D36165E01CFA54468F34B

SHA1:

EF62F4C1CB28610E75664B53DDCCFCD0E80A6B9D

SHA256:

5061F35B959D1A36808515A9EF02FA92B54BD0448E38C5D9EEAB3A89D5C5E97A

SSDEEP:

3072:OH8zkfwmP3qVRDp/ziq5bAl5E63briHLbdlgbvEuLpsJRbQuaJd8FGnwkHLuaVVV:3g16VRDNzpAPiHfdovEupsJRbQuaJd8u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • iexplore.exe (PID: 856)
      • iexplore.exe (PID: 7276)
      • iexplore.exe (PID: 6032)
      • iexplore.exe (PID: 2644)
      • iexplore.exe (PID: 7280)
      • iexplore.exe (PID: 7952)
      • iexplore.exe (PID: 7312)
      • iexplore.exe (PID: 1056)
      • iexplore.exe (PID: 232)
      • iexplore.exe (PID: 5352)
      • iexplore.exe (PID: 4408)
      • iexplore.exe (PID: 7800)

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 7276)
      • iexplore.exe (PID: 2644)
      • iexplore.exe (PID: 7280)
      • iexplore.exe (PID: 5352)
      • iexplore.exe (PID: 7312)
      • iexplore.exe (PID: 232)
      • iexplore.exe (PID: 1056)
      • iexplore.exe (PID: 7952)
      • iexplore.exe (PID: 4408)
      • iexplore.exe (PID: 6032)
      • iexplore.exe (PID: 7800)
      • iexplore.exe (PID: 856)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 856)
      • iexplore.exe (PID: 7276)
      • iexplore.exe (PID: 2644)
      • iexplore.exe (PID: 7280)
      • iexplore.exe (PID: 7952)
      • iexplore.exe (PID: 5352)
      • iexplore.exe (PID: 7800)
      • iexplore.exe (PID: 7312)
      • iexplore.exe (PID: 232)
      • iexplore.exe (PID: 1056)
      • iexplore.exe (PID: 4408)
      • iexplore.exe (PID: 6032)

  • INFO

    • Checks supported languages

      • 2018-12-20-Ursnif-retrieved-by-Hancitor-infected-host.exe (PID: 7504)
      • ielowutil.exe (PID: 7428)

    • Reads the computer name

      • 2018-12-20-Ursnif-retrieved-by-Hancitor-infected-host.exe (PID: 7504)
      • ielowutil.exe (PID: 7428)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 5428)

    • Reads the software policy settings

      • SIHClient.exe (PID: 6388)
      • slui.exe (PID: 6668)
      • slui.exe (PID: 7580)

    • Checks proxy server information

      • slui.exe (PID: 6668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Clipper DOS Executable (2.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:12:25 07:08:01+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 97792
InitializedDataSize: 196096
UninitializedDataSize: -
EntryPoint: 0x12bf7
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 7.0.0.0
ProductVersionNumber: 3.0.0.0
FileFlagsMask: 0x004f
FileFlags: (none)
FileOS: Unknown (0x40534)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (457A)
CharacterSet: Unknown (A56B)
FileVersion: 2.6.3.51
InternalName: fapene.exe
LegalCopyright: Copyright (C) 2018, xuwih
ProductVersion: 2.6.3.51
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
170
Monitored processes
33
Malicious processes
18
Suspicious processes
5

Behavior graph

Click at the process to see the details
start 2018-12-20-ursnif-retrieved-by-hancitor-infected-host.exe sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe sihclient.exe iexplore.exe no specs #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
232"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7052 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
856"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4188 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1056"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6540 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1180"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2096"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2644"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1180 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3032"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3968"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4188"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
50 262
Read events
49 937
Write events
271
Delete events
54

Modification events

(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{5EED0EDB-0925-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(5428) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
Executable files
0
Suspicious files
55
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7276iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
2096iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{781324DE-0925-11F0-B4ED-18F7786F96EE}.datbinary
MD5:BC6411837292B46CD40F5290F0D4D0A9
SHA256:05FDE11C3967C4DD621653D6041F2689E4D2E7100845888C2256B60C370A7A9E
8136iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFCEE690BA60CDBFEE.TMPbinary
MD5:38283390BEAE5229A10476D90C525FAC
SHA256:B62E49998FAEE871ED8F120264A2AF28C67F240D1253C0116B5FB5EF173BE3E1
2096iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF8B1A31F3F0C0408D.TMPbinary
MD5:6723C50A832D605A14FD6B6AC6ABA7EA
SHA256:CC8BE0D777710352467D5D0938094351B64BBFE18D79B50962E983FAB44FCC6B
8136iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{84EFF593-0925-11F0-B4ED-18F7786F96EE}.datbinary
MD5:6E9C44905CE1FDE5F23E48DFFE0917A9
SHA256:967F2250FAB4CCBA6B98EBD455F7CD3809A95227BAE331C65A305FCC41562BA3
2096iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{781324DC-0925-11F0-B4ED-18F7786F96EE}.datbinary
MD5:BF11A642E12E17DDDBFDD46B88AA1E87
SHA256:—
8136iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{84EFF591-0925-11F0-B4ED-18F7786F96EE}.datbinary
MD5:BD99B80100B63C304DDBCE5D90B0263A
SHA256:A2CF4FC57982ECEA6F2CE56BD03FBA5BADF139329529F57EC6D132A3061EA74C
4188iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF9A374F88866B0B88.TMPbinary
MD5:A7967FF6897B9960F40085ECC0CA7C55
SHA256:C576FF38E3EE468F4E4DE8DFF4F6729E1ED4F8A3C1934CED59FBF38CDF6303AD
5428iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{5EED0EDB-0925-11F0-B4ED-18F7786F96EE}.datbinary
MD5:611E7CAD220B172D6389B54E0A4A13F5
SHA256:1B31CDDF81592C5A234CEA1F360842577E3321E1A46E4BB1A2BC9AB9B6D38753
4188iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{91CED9E2-0925-11F0-B4ED-18F7786F96EE}.datbinary
MD5:8A05A7264C0925771920263E577AD49C
SHA256:5C78B9ED781CBF7D5F7F1F0905B48C2B593CF70E1FE33CC5079C2230AC23586B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
90
DNS requests
35
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6032
iexplore.exe
GET
404
49.13.77.253:80
http://in.extermas.at/webstore/aunqSk6C/kvuM6JhswKiev5NKzzwlR8T/621jJ6Hb6P/ivJWIzsjGR3lF4ZtF/QIlO37B5OZ23/X2eLHWwF5uL/aDUzY8vJP8OscB/QkaVDG8iYtfF71bAdRmXo/rHyAy7s2qgOk75CB/c5jVJD5PLQrRRMD/CvYcPCrVZgW0nUWG_2/FQ_2FggSl/h_2BHTYHMdAxZhexAxga/jt0SP6DRQ2tABFTZrH2/tRhsNXq1gDYqhwgIerVeFr/ePWo_2BT
unknown
—
—
malicious
7800
iexplore.exe
GET
404
49.13.77.253:80
http://ax.zaravid.at/webstore/lPsJLiZgNrp7X0JQgqQTLTG/lrLE2rucJm/xSno0ZOddGyDoGPTz/p8kkA333jT5J/Rxs_2BUo4rV/KtbZiXvdCZ3bYj/4pmtLYKosJo0dr1g0i_2B/aWu_2FBWW5A9HTpQ/o_2BLHSHkMC2XWv/PZIv8djAgiwPv4sd9_/2Bv57u_2B/C6pDDYR_2FI65LqiakcQ/9ZkQYDVR6h3k2Qp7G_2/FzGP19RhsR7aGRfT8ZhYun/IZu
unknown
—
—
malicious
7276
iexplore.exe
GET
404
49.13.77.253:80
http://api2.doter.at/webstore/pKPdYk3WTG2wE/SQYG2eJT/t9mKLMs4m2lgqVpomc0j0S1/tpaExdRH7n/ZVBZelb6qB2FV_2Bm/OMA6FiSU9Eyl/RHuSU04yMZv/CUTYwyytYSBG87/08gF7XfMFEqIuKn3PnBtZ/WPOzJ9_2FWfc1pJO/p3Eigtm28NEp4Hp/j5_2F7E0UOSyfQpxSL/_2FKAscwy/MgqcigvxWbigG8qUKF6r/6FQ8CzUiHv/vJNof
unknown
—
—
malicious
2644
iexplore.exe
GET
404
49.13.77.253:80
http://gif.doter.at/webstore/9w9ViefSud0MvWnn9XIrM/9Z8OXeiKMTLkK3X7/Wu47gzhSgmxIqSl/AnEoljy4gxp4XJeot7/jv1qtGY4F/AufuNUSbQquHumtsVEom/rDGEl73VdvUn68727Xh/RMRBo54gZ_2BGJzlQ5IRKr/XVgkqyw2T0NzR/usz6BJQ2/1mzjT91y8O5Z6FHrdhWSX99/cBUviqXb1Q/B_2BP7G_2FvYoRkLM/8GvZxdJkPas0/EPArawq0iP5srByx2/V
unknown
—
—
malicious
856
iexplore.exe
GET
404
49.13.77.253:80
http://g2.ex100p.at/webstore/PwY0ldYGsM7dRrxpO0EHgAi/yNHdktGEtK/4SqU9SM_2B_2FbofH/F3i2SEdwYB09/JdjPK6omBOY/BP2a4WNZ08Gysb/nVMSLMXFMPPa8wyCjEzig/1AirPLiPTMNwJ4JI/mtIO2Zx1LzR7X14/wimghu6XC5XQNhdske/9Z_2F4mMI/_2BV97sWszNXBYvtE_2F/9Yc09Ax40oPiCSKfK_2/FqZfh9quvPxch8nH/Yia1I
unknown
—
—
malicious
7280
iexplore.exe
GET
404
49.13.77.253:80
http://extra.avareg.cn/webstore/LGVI6KIeo4/R5woaiQsA3rCjzPv_/2B9lRXLJDBML/olekl28urK9/9S9ZXx3zE2ZTOM/xoalJX2kJ1rA3EM1NVYdY/px4bdJoFve15ItlW/y680PiTJQ8kkOIN/ACjpUk_2BFt_2Flbty/MmB_2BVMz/4pIj9PuftddKMZX3fFYC/j_2BFolBtwwtEBNp2LF/gQyxMJNjWAqVvslcDfVdTj/o_2FtH2bOqUOO/hqiUiQ2m/5iTjerFRFwUNm3Isc/ag63W
unknown
—
—
malicious
5624
iexplore.exe
GET
404
49.13.77.253:80
http://foo.avaregio.at/webstore/uL7QsAzI75UjNkm4t52l/paAwvbPxhfe4lJO7T9a/N_2FFH8Atz2mJiwg05IMSF/Wb7oZWvFWbOiy/ekayE_2B/mJBZ3pIneDPUbr2oUjG46mt/H99l9KEIwE/0j7d4DiY71F6uk5EM/jOsON7vHy1xn/BGrXFdOp0kj/3hri1VsOVW0j_2/BpXYMVCjl67bWgdZQ0SNS/kYD_2FxeeB62Zvjp/NCmC3Hy8wYtv5ol/f
unknown
—
—
unknown
5352
iexplore.exe
GET
404
49.13.77.253:80
http://op.iovbased.at/webstore/C1BXOEVZREBk1qmiKieXo/LHiG65TNNZlemkAJ/9KS_2BkUnQJB8gk/5SSJdaEE7TpEgMLZUn/5RBmDh6Ab/Tg4EV_2FZWDpuyJ5h10F/rtan_2Ff_2BFgJLDJW4/pDBv41IpQJbMNt9thnXwde/s7yr7BQ21LJ0R/rACOZpqK/wo0kR74xkhZsifFrV3C5f8k/ivc_2BU3qv/Xlih8oeKDiowVt1pQ/q51GhhqkfX82/vZS8C_2F5To/gVFO9aV5/6yjgC
unknown
—
—
malicious
7952
iexplore.exe
GET
404
49.13.77.253:80
http://ws.doter.at/webstore/2FzoD_2FLwu1/sD_2F1Zx7SF/b6y8pmUGj0GktY/d5TDO_2FidigEZGe2MbUO/9o_2FfrOwZ2o2BK_/2F6wv15z9MtUN0W/mB3drlm0PRdLwpfUak/mmDwghVIl/F7A5IvDCAdO0ajDKUwwJ/_2BAlNpeoEhnDb7ne9i/5EMDt2_2FHlp6GkLLhbHPK/zo_2BqmSc40xZ/UZLQ_2Bs/KC_2F9mWiN_2FBxLzNbHtve/_2Fr6Rx6ybGnrcNC/L
unknown
—
—
malicious
7312
iexplore.exe
GET
404
49.13.77.253:80
http://f1.cnboal.at/webstore/0w_2FfNCeG6/3AQ5b748PjxWaw/VVSghgwl_2FsNbl_2FcT9/uLeDeqAFlYTn8QUd/eqQG_2BWJEm3OCY/0Q3aopNMRRS30CqBUM/XahcGk9Zu/MzXsApgQwLVE5EC3qCg5/WVcSTfgWu8ovAirkIaP/CDI_2F2rFatjXaQoSF0ssO/X3D0c2tcLKwbp/LhdkuJjP/bNl7iT5pvC9zG_2FBHaEL9k/34jkKhvaEi/dKb3WHkvcq9dIUyfT/4vCWZ7wP/pIM
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7732
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.68
  • 40.126.31.128
  • 20.190.159.73
  • 20.190.159.23
  • 20.190.159.64
  • 20.190.159.71
  • 40.126.31.71
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.74.47.205
whitelisted
api2.doter.at
  • 49.13.77.253
malicious
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
  • 2603:1030:800:5::bfee:a08d
whitelisted
241.42.69.40.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
7276
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
7504
2018-12-20-Ursnif-retrieved-by-Hancitor-infected-host.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
6032
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
7800
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
856
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
856
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2644
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
7280
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5352
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5352
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2018-12-20-Ursnif-retrieved-by-Hancitor-infected-host.exe