File name:

2018-12-13-Ursnif-retreived-by-Hancitor-infected-host.exe

Full analysis: https://app.any.run/tasks/6e8b78fa-3eb4-4bd5-bce5-c639636c5a0d
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 02:54:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

44E3B034DC5201E6230D49AC09E94996

SHA1:

0342B47DC27DF37947C06391C46209C13B9B3D07

SHA256:

8C8184CD9D5EA4E9E04DFEAE2059985320A2F63751E63309C2A3015792ABEB8C

SSDEEP:

3072:iPluzTc+wjPwwPmN3fENMp3f/jOxe8cO4n/LCB4zLS3i47L76KVVCcxATew15tr:xcnjPkNsW3H/WSze3BxATj155

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 1164)
      • iexplore.exe (PID: 6344)
      • iexplore.exe (PID: 616)
      • iexplore.exe (PID: 2432)
      • iexplore.exe (PID: 5596)
      • iexplore.exe (PID: 5512)
      • iexplore.exe (PID: 1020)
      • iexplore.exe (PID: 4736)
      • iexplore.exe (PID: 5112)
      • iexplore.exe (PID: 5936)
      • iexplore.exe (PID: 2796)

    • Connects to the CnC server

      • iexplore.exe (PID: 1164)
      • iexplore.exe (PID: 6344)
      • iexplore.exe (PID: 616)
      • iexplore.exe (PID: 2432)
      • iexplore.exe (PID: 5112)
      • iexplore.exe (PID: 5596)
      • iexplore.exe (PID: 2796)
      • iexplore.exe (PID: 1020)
      • iexplore.exe (PID: 5512)
      • iexplore.exe (PID: 4736)
      • iexplore.exe (PID: 5936)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 1164)
      • iexplore.exe (PID: 6344)
      • iexplore.exe (PID: 616)
      • iexplore.exe (PID: 2432)
      • iexplore.exe (PID: 1020)
      • iexplore.exe (PID: 2796)
      • iexplore.exe (PID: 5512)
      • iexplore.exe (PID: 4736)
      • iexplore.exe (PID: 5596)
      • iexplore.exe (PID: 5112)
      • iexplore.exe (PID: 5936)

  • INFO

    • Checks supported languages

      • ielowutil.exe (PID: 2908)
      • 2018-12-13-Ursnif-retreived-by-Hancitor-infected-host.exe (PID: 6148)

    • Reads the computer name

      • 2018-12-13-Ursnif-retreived-by-Hancitor-infected-host.exe (PID: 6148)
      • ielowutil.exe (PID: 2908)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 2568)

    • Reads the software policy settings

      • slui.exe (PID: 5072)
      • slui.exe (PID: 4452)

    • Checks proxy server information

      • slui.exe (PID: 4452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:05:17 11:35:14+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 44032
InitializedDataSize: 129536
UninitializedDataSize: -
EntryPoint: 0x16be
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 7.0.0.0
ProductVersionNumber: 3.0.0.0
FileFlagsMask: 0x004f
FileFlags: (none)
FileOS: Unknown (0x40534)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (457A)
CharacterSet: Unknown (A56B)
InternalName: jexarecigo.exe
LegalCopyright: Copyright (C) 2017, gemunahu
ProductVersion: 6.4.5.72
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
31
Malicious processes
14
Suspicious processes
6

Behavior graph

Click at the process to see the details
start 2018-12-13-ursnif-retreived-by-hancitor-infected-host.exe sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe slui.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
744"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
872"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1020"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6424 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1116"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1128"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1164"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1164"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1168C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1748"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
46 641
Read events
46 327
Write events
260
Delete events
54

Modification events

(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{7D164D85-0924-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
Executable files
0
Suspicious files
54
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1164iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:F0E038931EC1BBB7E37A93F9A70814D4
SHA256:9BB5F8C714ACF6A422AD666B77BDF0C212752A83A0C38F782DE3B55CA5422467
2568iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{7D164D85-0924-11F0-B4ED-18F7786F96EE}.datbinary
MD5:8E2B37A1E89D15BBFC22EA8C367B1A2E
SHA256:E8DA9AE471E8DB7CA732DC616E26CCB4C9E3587E93ECD61DA9CB7D5F1FF69A15
2568iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFB345A639E50ED5C9.TMPbinary
MD5:D737C7D714BC2E5EDC0A5BC871E06986
SHA256:C46D16F6C9D7E41AFFE23B38625E971D98240A19F5C54B59BD182C1833F8427D
2568iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{7D164D87-0924-11F0-B4ED-18F7786F96EE}.datbinary
MD5:E7D0B1EDB1AD83333A0428AF24AFA5A7
SHA256:FB9115AF5F51FD311C90F0A26D5E4235EDC241B5CFF5EADF441B866AD688250D
1116iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{96405AB0-0924-11F0-B4ED-18F7786F96EE}.datbinary
MD5:86631A579904A88C385BFC8F22531C44
SHA256:FCA5DC9EA27D79893994009408D7D530B6B04316D6BF8E6ADC85F25A84588C4B
2568iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF638B1BD63C87255A.TMPbinary
MD5:EEEBB27098A0CA52A4FBDE85B7574B3A
SHA256:3BFD75A9F83361FBF048502D215B2C40D65B3CA7F964B867E920DE5EBC2BF663
1116iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{96405AAE-0924-11F0-B4ED-18F7786F96EE}.datbinary
MD5:8F35033B545C46806B37264B8B24BD95
SHA256:B9D946950A58D2CFD09B370521409B0CB6A6CF52AC4D36F91FEB1B5DE189A2DB
1164iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
1116iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF86217CA6B8E5B999.TMPbinary
MD5:722479D9E475291BCC4D48295E04F9E9
SHA256:2D54DBAF480EBDE11F29574F4C7123E639B3364644ABFD2E024BA5C2C4292104
5124iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF14625940E0D685C2.TMPbinary
MD5:6340130DB5E887964651CCF718635E75
SHA256:C80655A86D87EA66823071A9EC875CD60D1A146AB27BCFAD3D419CD0131E47BB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
95
DNS requests
33
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1164
iexplore.exe
GET
404
49.13.77.253:80
http://api2.doter.at/webstore/wxgX0B9SFio/YaQU7Cn7DkEA0m/kgQ3CIPc1Yc_2FOOj6Frf/q9CtVRSVoejUyy4e/f_2FepIRNFFOE_2/FSLJmbPlSiqOH_2BD8/zCpKHIU1H/OJBnGA_2FHV8MAiIk7SQ/HgYcUP4PnEqt7ZxaV19/8Bxw69EWfZ79dAS3jvsS54/6AiIWQdiXYOd3/5PZkYmz2/3HdE4kaBa2l9hn3yn_2Bknc/ZhpDsQuGwSH/r1Py91
unknown
—
—
malicious
6344
iexplore.exe
GET
404
49.13.77.253:80
http://in.extermas.at/webstore/MpBfclRs/e9iaRc6bnMera3CMjeH492c/JIYcnujPOL/X5de8ysl98z6W6Liu/GN_2FDT0aylx/eCX5gz4x_2F/XYDM5P7BvnEZKh/VNiVd2QXBp_2FtVrJJdLW/hXmwBLViiXHFh2gj/CGSKanBKli5lrV0/2hdArO7oC5rO8mEEdg/BdVLLSwqO/e5_2FE3Jdwu4nJVFZ1il/LhJklQfPsezfRb8oRkb/rYc_2FrYRrbFxGoASBqnvH/ZZn1h_2FL/ywn
unknown
—
—
malicious
616
iexplore.exe
GET
404
49.13.77.253:80
http://g2.ex100p.at/webstore/CNvwFY1oV/xhH3MEhfMnfhQLsYDobt/B7_2FQrYfLd8ZWuqoVH/JIWDRRwoog2qvwLsnaSJn2/svQgam3wBh6gR/noUvgblQ/VmSkrQybV74xvsYx2d0hOSX/g7A7pDPKYk/TguPtmPIbLCABcvfi/ImGCV_2BQged/yt8udM1a8jj/pTuxawmA7R6tju/YTKqx_2F_2FwZg2Uuej05/FxbWCeB7fu/ffPL1GXUgTyE/Q
unknown
—
—
malicious
3124
iexplore.exe
GET
404
49.13.77.253:80
http://asx.zaronif.at/webstore/FodjGWXMfGcmrnmY/x8kUuRwI8WptNcF/NwEgbVIjAxNqZlSEcA/OFjr3KRHz/raWGN_2Bjsg_2FLzJBK_/2Fj66I0g2HXnIXJ_2Fr/u705ylytDARketgTeOOZiS/cRBJ4i5LZETK1/Qlld59NL/32FNiFVSYXqlYRSjifudqUO/T1nkIVAIyR/cVUiBjZcfpZAuziF0/bFFQijwFCnVT/QPa14xJPNEtcw3N/ypbtC
unknown
—
—
unknown
2432
iexplore.exe
GET
404
49.13.77.253:80
http://gif.doter.at/webstore/U_2B8jstyV5m_2Bm/EEsDePQWb5llAmo/MXdJruXyeBge69VW6L/ZuD5Eb0Ox/yYNhw3Rtz6GPDyMxSvou/nDvUOncbp2_2BwwAZ4v/iVPLVZSuXi3s2sHheco_2F/eBV11reY5h6ch/v0BiC5NY/ANdj5cSf4vn0AeMgNewzCf2/xV4x7HaCmI/4luhb0s7mp86M2mYE/VSegh2jd5AaB/2dwa64HgghP/txCA3FMy/X
unknown
—
—
malicious
5596
iexplore.exe
GET
404
49.13.77.253:80
http://extra.avareg.cn/webstore/YIN57ZHC4kyjwZBdnL9/EaZghlAXcWGHCLUHkIiNeK/Kkgif9hbnIn5j/JC_2BRXH/LEAXixX08fNuErLBtp4T5oe/M_2FEtODv1/_2Bvy7c_2FMnzlwkZ/xc52Q_2FMBN8/zx8kNfSbqAC/BJj7CcpxsBk2dg/LUhJMHtkglsyhhZP5XKv5/h932WlXKXWkGVfxF/82JwBeMPHX7Q0E9/zyngIybftzI/uAGAcSSv5/Cuf
unknown
—
—
malicious
2796
iexplore.exe
GET
404
49.13.77.253:80
http://foo.avaregio.at/webstore/dfpkC98zX/rpx_2BurrkziMilR2_2F/KFZDhbXfKy3heLyO5oL/83FpmsexdOD3e1fVAVOt8D/vUDqRldGUwcCB/tmUjG8ja/rK8VhWZJLI_2FgpjL3JGjDf/y3j6fQdBrh/DetapEtaWiNBwUHiM/pegbT4yrbhbT/LFjXxiBEZiL/frbuJho7lKd9yj/gPT8n8IP_2BtOBx8C4h3_/2BbEqrtNzThpLskj/93mfOGKf/O
unknown
—
—
malicious
1020
iexplore.exe
GET
404
49.13.77.253:80
http://op.iovbased.at/webstore/JTEGa7YMOceuE/sxZIjBZB/J7NrvfBOZU_2BzFskoQTSk9/8Ax6ZKClup/JDchuu5bEDu14_2FH/PzxaMFsykueK/mNk32nM84Sm/_2F2wYhSzVhG_2/B4aAFHxOwofIHpMgG7yVD/7NtCFAmR_2BI0u_2/BZyWhExfg6qF79O/_2BYzDAjp8gz2crXWX/rmqjN4xru/xvUEFzQsvZ6eaSZ2qrZX/qhihI9uK5B/a6m1FXc2/FvM
unknown
—
—
malicious
5512
iexplore.exe
GET
404
49.13.77.253:80
http://ws.doter.at/webstore/TVg6E36LnUVvrq9Y/MLyL_2BIUnEtLdY/cTbnS_2FlptA_2Bn6v/6i6aroG7U/Em5mzqBgLxk4eMC5mzQM/QXP2qIJ7PNoK_2BbPEg/X2SD_2BppYbUtS9qZjMwDv/m9rUw_2BhZdHd/Pr0Uq0iT/u6aGRVA_2FU1IQGuCuoQWKB/vcwaq_2Bbi/ytx1UKse9NFHV8_2B/fbDtzHr2y5Sd/gAklTPTXPkZ/tK6XFX06oO3wYO/CqRbi
unknown
—
—
malicious
4736
iexplore.exe
GET
404
49.13.77.253:80
http://f1.cnboal.at/webstore/3uPccV1GTu/sF0xa9OAvuRWZ0X76/fSRqfJ3RQ40h/Sjai6LDKyFv/MJ_2FLbA60B_2B/m_2Bp7BpS5LnakYhh0C2y/PAkRWhfNdKRee2EF/_2BTLbOKJgtotOB/GpLDrwigPSbxp8Xj4b/PqdiYa1qX/k9o8jt_2F9l2_2B89Yed/pV5W0SqDcuXCRnPnBYu/hwrBgZgXvIWtpuK_2B2wAf/1NIhUv_2FDpT7/0UPRvaODTxip/D
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1164
iexplore.exe
49.13.77.253:80
api2.doter.at
Hetzner Online GmbH
DE
malicious
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 172.217.16.206
whitelisted
api2.doter.at
  • 49.13.77.253
malicious
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.0
  • 40.126.31.130
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.71
  • 40.126.31.69
  • 40.126.31.128
whitelisted
arc.msn.com
  • 20.199.58.43
  • 20.74.47.205
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
  • 2a01:111:f100:a000::4134:4847
whitelisted
15.164.165.52.in-addr.arpa
  • —
unknown
7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
1164
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
1164
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
6148
2018-12-13-Ursnif-retreived-by-Hancitor-infected-host.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
6344
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
616
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2432
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5596
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5596
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2796
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
1020
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2018-12-13-Ursnif-retreived-by-Hancitor-infected-host.exe