File name:

2019-09-04-initial-Ursnif-binary.exe

Full analysis: https://app.any.run/tasks/d59d2b28-4f5d-473e-b636-b6fb4a146ca6
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 06:38:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

B2490C2F4F8D22DDB34B4CBECD3C69B3

SHA1:

59154CB6A203E00FBE0431281B2BB33E1B00061A

SHA256:

831F0C2B7E7F4E4041AB3C5F6A7E9E41EB67DC7EFEE0246C0BC3335201058B6B

SSDEEP:

6144:3FpD3NeAyfD4DG2W00Lan6rzyYLd2dKcfUF22Q:V9NeA68C9U6vyY8dKw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 1052)
      • iexplore.exe (PID: 1096)
      • iexplore.exe (PID: 1660)
      • iexplore.exe (PID: 644)
      • iexplore.exe (PID: 7000)
      • iexplore.exe (PID: 5548)
      • iexplore.exe (PID: 5136)
      • iexplore.exe (PID: 1184)

    • Connects to the CnC server

      • iexplore.exe (PID: 1052)
      • iexplore.exe (PID: 1096)
      • iexplore.exe (PID: 1660)
      • iexplore.exe (PID: 644)
      • iexplore.exe (PID: 7000)
      • iexplore.exe (PID: 5548)
      • iexplore.exe (PID: 1184)
      • iexplore.exe (PID: 5136)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 1052)
      • iexplore.exe (PID: 1096)
      • iexplore.exe (PID: 1660)
      • iexplore.exe (PID: 644)
      • iexplore.exe (PID: 7000)
      • iexplore.exe (PID: 5548)
      • iexplore.exe (PID: 5136)
      • iexplore.exe (PID: 1184)

    • There is functionality for taking screenshot (YARA)

      • 2019-09-04-initial-Ursnif-binary.exe (PID: 5072)

  • INFO

    • Reads the computer name

      • ielowutil.exe (PID: 1452)
      • 2019-09-04-initial-Ursnif-binary.exe (PID: 5072)

    • Checks supported languages

      • 2019-09-04-initial-Ursnif-binary.exe (PID: 5072)
      • ielowutil.exe (PID: 1452)

    • The sample compiled with english language support

      • 2019-09-04-initial-Ursnif-binary.exe (PID: 5072)

    • Reads the software policy settings

      • slui.exe (PID: 5596)
      • slui.exe (PID: 2960)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 5164)

    • Checks proxy server information

      • slui.exe (PID: 2960)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (35.9)
.exe | Win32 Executable MS Visual C++ (generic) (27)
.exe | Win64 Executable (generic) (23.9)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:09:04 11:36:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 190976
InitializedDataSize: 155648
UninitializedDataSize: -
EntryPoint: 0x207ae
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 3.0.46.81
ProductVersionNumber: 3.0.46.81
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Worlddecide Exinda
FileDescription: HeldPerson
FileVersion: 3.0.46.81
InternalName: HeldPerson
LegalCopyright: Copyright © 2001-2012 Worlddecide Exinda
LegalTrademarks: HeldPerson
ProductVersion: 3.0.46.81
OriginalFileName: At.exe
ProductName: HeldPerson
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
30
Malicious processes
9
Suspicious processes
5

Behavior graph

Click at the process to see the details
start 2019-09-04-initial-ursnif-binary.exe no specs sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
644"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6048 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
776"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1040"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6040 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1052"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5164 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1096"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:776 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1184"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4188 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1196"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1452"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -EmbeddingC:\Program Files (x86)\Internet Explorer\ielowutil.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Low-Mic Utility Tool
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\ielowutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1660"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
47 057
Read events
46 771
Write events
239
Delete events
47

Modification events

(PID) Process:(5164) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5164) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5164) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5164) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(5164) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{ECA25C51-0943-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(5164) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(5164) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(5164) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(5164) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
(PID) Process:(1052) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Content
Operation:writeName:CachePrefix
Value:
Executable files
0
Suspicious files
46
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5164iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFF0BB379E2A3792BC.TMPbinary
MD5:A373330837728BA5319A9EC7D0E92522
SHA256:6E13E6966C1134FB5C138ACC3A69D90505CCD5D948D4F6C07424F2B27ACD9A31
1052iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
1196iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFF385DD4AE3913B37.TMPbinary
MD5:2C6515FE341EF0C8A2E19302D605DF47
SHA256:D802A021822140B22691C1DF18A36D613E375E3E0BA2D4AA6E221A6CC7EC491E
776iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF6E128BA79C445ADE.TMPbinary
MD5:DAB88A54F4D81B2D08F219F53647280D
SHA256:DBBD809E06549378A4887F38BAB0E51947D15CDD65AC3D6D3F46FA511A3DA9CD
776iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{05CC44C8-0944-11F0-B4ED-18F7786F96EE}.datbinary
MD5:2CC2E687ACBBC921EC86A594A01E26A6
SHA256:A35B763089FC63A66F91B6FDD057F8B2AC8A338431EF8C5BC907B7A4FC38FB73
5164iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{ECA25C53-0943-11F0-B4ED-18F7786F96EE}.datbinary
MD5:6101AE1F993419F369733775BE93D90E
SHA256:A4F82C5904E516A5C894CF64A2B405276D0286EFF70CF9AA96EC62A8D7D6119D
776iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{05CC44C6-0944-11F0-B4ED-18F7786F96EE}.datbinary
MD5:96DE13ED2F8F435CF738760BFCD5AEF4
SHA256:97738B9490FF34982F394523131A3700BAE3FD2C702CB3172AB422B338950E78
1196iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{12D61A6C-0944-11F0-B4ED-18F7786F96EE}.datbinary
MD5:001C944EAE9107B559D94397AD1687E6
SHA256:DF7F249AC32E9EA7F7FA0D9A10E7BDF490760D3436D6851588BA81C093F9CB39
5164iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{ECA25C51-0943-11F0-B4ED-18F7786F96EE}.datbinary
MD5:7D7F8AB27D47C6ADD0BD21DEEA85023E
SHA256:B3381F781F6A3B0646AF9C1AF60F4215B0B76187A89AAC5BE3C707F9F814DEB8
1196iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF55D0117BB781BB2E.TMPbinary
MD5:ADE66D513E231F25425AC920CE264B16
SHA256:F91C8D56F832D333F7A3117083ADC3B28E67A6C50AA059071A10FA93962DF0D6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
87
DNS requests
27
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1096
iexplore.exe
GET
404
49.13.77.253:80
http://tcolleen4463dn.com/images/i6cenRJY9Rs5m_2Bm9J0/OAovP813fhuyj_2BwwT/yJDWWmO8SVt8rwa4LBu2kj/gyggtjA_2B6us/E4Ll2mzA/ZOS_2Bdz0jbJki_2F_2BDUn/jg2U1CU5zp/YnnCvNZlQkJq_2F5c/52aeuEJCdqM6/Ufva0ZrzMK_/2FxMmKE1_/2B4k.avi
unknown
—
—
malicious
1052
iexplore.exe
GET
404
142.250.184.238:80
http://google.com/images/1uu33qGJTAMBKWB/B8_2B9IHulUP_2B9fe/56n9QokM9/YzGlWBzSZL5W60oQgeEQ/qAi3gVm4UUu8OnnCrVV/5dESXBr6QXyUVyswPH9xwD/VmSuHVwWzJAFG/eNoifPBM/YNQ35uw2ZRGBreU9KVP3W6h/lUnW053.avi
unknown
—
—
whitelisted
1660
iexplore.exe
GET
404
49.13.77.253:80
http://v57zfvp.com/images/EokfsXmaI_2BFIMADIECkv/BD8J_2Fxw18Ww/HCTxz6zJ/JrnFQT8l3aRfRlBuuEB10zZ/7g1C_2BdCM/LeWglgDlt9jHmb2Jx/KiAwg4zmw8hu/FeGHnTxXZJH/a7HbL15JGO6QSa/8_2BTKcglEsGIdQCTI2ky/u8B_2BNU/x.avi
unknown
—
—
malicious
644
iexplore.exe
GET
404
49.13.77.253:80
http://hateatate.xyz/images/oBS2LJvEW7NYFvpRzz0/d2L_2Bo6bUPXs5jYsUho_2/BisL9_2FaPwtp/K_2FGpiK/n6TgYY7meW27iqtNgVolD64/swDh8Un5lu/RE_2F1_2FKTHso9RM/9Ehak1Qey4DY/Za3wwbtiO8m/t2dVojbFRRPTSc/LlI0x_2BQ8xgU_2/Fh.avi
unknown
—
—
malicious
2796
iexplore.exe
GET
404
142.250.184.238:80
http://google.com/images/2emJjuZOBmkyjSm/OArPnybNhrhvIPsHd8/IqMRkUfdh/Ruw8tTayh3M7EQ8HHSOE/NVE2YQ8lXb1eRZZmFeV/9X1XzGvvZAD63_2BoSzfeG/6QW3njVsLy1Yk/RSqU2tJm/ZJAYUnn8NiSTrapqlG_2F3t/M1d6vDN.avi
unknown
—
—
whitelisted
7000
iexplore.exe
GET
404
49.13.77.253:80
http://tcolleen4463dn.com/images/HnkSb7YkE/q0SR6AY2Nqo2A4lu23dc/IkQAkE59epg7VGfkqGZ/kE_2BhdOCRZcI7xCFOpRt_/2B0zmaX_2Fdar/mFh5xrG_/2B4lffpUuWKIinzkTGeXpUY/_2BjJGSIx2/kqQVS5AKTke5zr89W/SGRXPELIS/lZq2X8m1R/M.avi
unknown
—
—
malicious
1040
iexplore.exe
GET
404
49.13.77.253:80
http://v57zfvp.com/images/H2tOCySNirvL/QkkZiyNdZL_/2FLJoC4DueFD4E/M8FSn_2FY7M720r1s9pV_/2B3Fxbas4A19_2Fh/oCPRpZncZcyT6R7/Fg9WkM2_2Bh0KSWb3I/xgXt8pmps/g41nVUxCKeBG02zSM1Bz/3vu4NBYUnPcar0UeqUy/tksxN.avi
unknown
—
—
malicious
5136
iexplore.exe
GET
404
142.250.184.238:80
http://google.com/images/gU9YZ_2Bna0mYXhuByUAl/RyMFi6YZ9iRvTbAF/9XOxBXhrMMhk0pX/I7_2BLYkumHPtZtcfD/KkLXEs32f/E_2BxjBrAPwZ1PVgjieK/nCultr4ATGFX_2F9G0Z/VzR8R0GtsyYEsK0T_2FlAY/z9LtOFmEz/7j1EkjqtRN/6.avi
unknown
—
—
whitelisted
5548
iexplore.exe
GET
404
49.13.77.253:80
http://hateatate.xyz/images/wqXI1W5jj_/2FsI27X_2F_2B236V/g3XUviP07QQc/BOsX5SIDWfC/laZpxZgIV_2FML/CmwBbYYn_2FhfRcbgq_2F/QmUXzQwvDwpYNQCR/2lk9okm1q4hF3Fy/UbR_2FGWFu3CodIGlr/_2BPS65Oj/_2BTDV4RoriJZwtaJY6a/tiPvd.avi
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1052
iexplore.exe
142.250.184.238:80
google.com
GOOGLE
US
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6040
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.31.131
  • 20.190.159.68
  • 20.190.159.129
  • 40.126.31.130
  • 20.190.159.0
  • 20.190.159.4
  • 40.126.31.73
  • 40.126.31.128
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
  • 2603:1030:800:5::bfee:a08d
whitelisted
206.23.85.13.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
1052
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
1096
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
1660
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
644
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
644
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
7000
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5548
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5548
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
5136
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
1184
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-09-04-initial-Ursnif-binary.exe