File name:

2018-12-13-Ursnif-retreived-by-Hancitor-infected-host.exe

Full analysis: https://app.any.run/tasks/6e8b78fa-3eb4-4bd5-bce5-c639636c5a0d
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 02:54:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

44E3B034DC5201E6230D49AC09E94996

SHA1:

0342B47DC27DF37947C06391C46209C13B9B3D07

SHA256:

8C8184CD9D5EA4E9E04DFEAE2059985320A2F63751E63309C2A3015792ABEB8C

SSDEEP:

3072:iPluzTc+wjPwwPmN3fENMp3f/jOxe8cO4n/LCB4zLS3i47L76KVVCcxATew15tr:xcnjPkNsW3H/WSze3BxATj155

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • iexplore.exe (PID: 1164)
      • iexplore.exe (PID: 6344)
      • iexplore.exe (PID: 616)
      • iexplore.exe (PID: 2432)
      • iexplore.exe (PID: 5596)
      • iexplore.exe (PID: 4736)
      • iexplore.exe (PID: 1020)
      • iexplore.exe (PID: 5512)
      • iexplore.exe (PID: 5936)
      • iexplore.exe (PID: 5112)
      • iexplore.exe (PID: 2796)

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 1164)
      • iexplore.exe (PID: 6344)
      • iexplore.exe (PID: 616)
      • iexplore.exe (PID: 2432)
      • iexplore.exe (PID: 5596)
      • iexplore.exe (PID: 2796)
      • iexplore.exe (PID: 1020)
      • iexplore.exe (PID: 5512)
      • iexplore.exe (PID: 5112)
      • iexplore.exe (PID: 4736)
      • iexplore.exe (PID: 5936)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 1164)
      • iexplore.exe (PID: 6344)
      • iexplore.exe (PID: 616)
      • iexplore.exe (PID: 2432)
      • iexplore.exe (PID: 5512)
      • iexplore.exe (PID: 5596)
      • iexplore.exe (PID: 1020)
      • iexplore.exe (PID: 2796)
      • iexplore.exe (PID: 5112)
      • iexplore.exe (PID: 4736)
      • iexplore.exe (PID: 5936)

  • INFO

    • Reads the computer name

      • 2018-12-13-Ursnif-retreived-by-Hancitor-infected-host.exe (PID: 6148)
      • ielowutil.exe (PID: 2908)

    • Checks supported languages

      • 2018-12-13-Ursnif-retreived-by-Hancitor-infected-host.exe (PID: 6148)
      • ielowutil.exe (PID: 2908)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 2568)

    • Reads the software policy settings

      • slui.exe (PID: 5072)
      • slui.exe (PID: 4452)

    • Checks proxy server information

      • slui.exe (PID: 4452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:05:17 11:35:14+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 44032
InitializedDataSize: 129536
UninitializedDataSize: -
EntryPoint: 0x16be
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 7.0.0.0
ProductVersionNumber: 3.0.0.0
FileFlagsMask: 0x004f
FileFlags: (none)
FileOS: Unknown (0x40534)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (457A)
CharacterSet: Unknown (A56B)
InternalName: jexarecigo.exe
LegalCopyright: Copyright (C) 2017, gemunahu
ProductVersion: 6.4.5.72
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
31
Malicious processes
14
Suspicious processes
6

Behavior graph

Click at the process to see the details
start 2018-12-13-ursnif-retreived-by-hancitor-infected-host.exe sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe slui.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
744"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
872"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1020"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6424 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1116"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1128"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1164"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1164"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1168C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1748"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
46 641
Read events
46 327
Write events
260
Delete events
54

Modification events

(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{7D164D85-0924-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
Executable files
0
Suspicious files
54
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1164iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:F0E038931EC1BBB7E37A93F9A70814D4
SHA256:9BB5F8C714ACF6A422AD666B77BDF0C212752A83A0C38F782DE3B55CA5422467
1164iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
2568iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF638B1BD63C87255A.TMPbinary
MD5:EEEBB27098A0CA52A4FBDE85B7574B3A
SHA256:3BFD75A9F83361FBF048502D215B2C40D65B3CA7F964B867E920DE5EBC2BF663
2644iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFD1ECD25F081058B5.TMPbinary
MD5:1391170E59661FA45D2152F9E8085D27
SHA256:B910B8ECAE4364C7B4096E70CA02F6C32B87E6C53FB4DBBCA44D8C81FF3D2D79
1748iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF3B41655917C8CCA1.TMPbinary
MD5:C785418F59A91D214B546F289413F24F
SHA256:C332E7787003E8487E2A4F7C29F7141B5E1B309F03D6DCCAB1154130F45D7A1C
1748iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{A318608F-0924-11F0-B4ED-18F7786F96EE}.datbinary
MD5:543AC2C804603822B813B58591D15656
SHA256:F857243291C17C057CB248F2CC03D262C74C647DE1AD3F8E37EBFF2C76EA15B6
2644iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{AFF4B2B8-0924-11F0-B4ED-18F7786F96EE}.datbinary
MD5:7E3F7384198431864CDE8476B9B6E1DC
SHA256:3BAD7BCA8110488A7215670ACF8C58D2883F9D8577C307844B9673EF314FD6FE
2644iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF0F7951DEAB7173BC.TMPbinary
MD5:423FFC635D7C0833C36747C4CA610DBB
SHA256:72D502B1446272999C2F522108ED43F6B615B101B255E7F9C549A34A7179C544
5124iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{BCD426E9-0924-11F0-B4ED-18F7786F96EE}.datbinary
MD5:B96AF577376C9A781994C7A4F6A28E23
SHA256:EA0F5739F0FE4BEDD708E3CFCD6B9F029909B97D82A9CA47285513F75950DF33
5124iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF14625940E0D685C2.TMPbinary
MD5:6340130DB5E887964651CCF718635E75
SHA256:C80655A86D87EA66823071A9EC875CD60D1A146AB27BCFAD3D419CD0131E47BB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
95
DNS requests
33
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6344
iexplore.exe
GET
404
49.13.77.253:80
http://in.extermas.at/webstore/MpBfclRs/e9iaRc6bnMera3CMjeH492c/JIYcnujPOL/X5de8ysl98z6W6Liu/GN_2FDT0aylx/eCX5gz4x_2F/XYDM5P7BvnEZKh/VNiVd2QXBp_2FtVrJJdLW/hXmwBLViiXHFh2gj/CGSKanBKli5lrV0/2hdArO7oC5rO8mEEdg/BdVLLSwqO/e5_2FE3Jdwu4nJVFZ1il/LhJklQfPsezfRb8oRkb/rYc_2FrYRrbFxGoASBqnvH/ZZn1h_2FL/ywn
unknown
—
—
malicious
1164
iexplore.exe
GET
404
49.13.77.253:80
http://api2.doter.at/webstore/wxgX0B9SFio/YaQU7Cn7DkEA0m/kgQ3CIPc1Yc_2FOOj6Frf/q9CtVRSVoejUyy4e/f_2FepIRNFFOE_2/FSLJmbPlSiqOH_2BD8/zCpKHIU1H/OJBnGA_2FHV8MAiIk7SQ/HgYcUP4PnEqt7ZxaV19/8Bxw69EWfZ79dAS3jvsS54/6AiIWQdiXYOd3/5PZkYmz2/3HdE4kaBa2l9hn3yn_2Bknc/ZhpDsQuGwSH/r1Py91
unknown
—
—
malicious
3124
iexplore.exe
GET
404
49.13.77.253:80
http://asx.zaronif.at/webstore/FodjGWXMfGcmrnmY/x8kUuRwI8WptNcF/NwEgbVIjAxNqZlSEcA/OFjr3KRHz/raWGN_2Bjsg_2FLzJBK_/2Fj66I0g2HXnIXJ_2Fr/u705ylytDARketgTeOOZiS/cRBJ4i5LZETK1/Qlld59NL/32FNiFVSYXqlYRSjifudqUO/T1nkIVAIyR/cVUiBjZcfpZAuziF0/bFFQijwFCnVT/QPa14xJPNEtcw3N/ypbtC
unknown
—
—
unknown
616
iexplore.exe
GET
404
49.13.77.253:80
http://g2.ex100p.at/webstore/CNvwFY1oV/xhH3MEhfMnfhQLsYDobt/B7_2FQrYfLd8ZWuqoVH/JIWDRRwoog2qvwLsnaSJn2/svQgam3wBh6gR/noUvgblQ/VmSkrQybV74xvsYx2d0hOSX/g7A7pDPKYk/TguPtmPIbLCABcvfi/ImGCV_2BQged/yt8udM1a8jj/pTuxawmA7R6tju/YTKqx_2F_2FwZg2Uuej05/FxbWCeB7fu/ffPL1GXUgTyE/Q
unknown
—
—
malicious
2432
iexplore.exe
GET
404
49.13.77.253:80
http://gif.doter.at/webstore/U_2B8jstyV5m_2Bm/EEsDePQWb5llAmo/MXdJruXyeBge69VW6L/ZuD5Eb0Ox/yYNhw3Rtz6GPDyMxSvou/nDvUOncbp2_2BwwAZ4v/iVPLVZSuXi3s2sHheco_2F/eBV11reY5h6ch/v0BiC5NY/ANdj5cSf4vn0AeMgNewzCf2/xV4x7HaCmI/4luhb0s7mp86M2mYE/VSegh2jd5AaB/2dwa64HgghP/txCA3FMy/X
unknown
—
—
malicious
2796
iexplore.exe
GET
404
49.13.77.253:80
http://foo.avaregio.at/webstore/dfpkC98zX/rpx_2BurrkziMilR2_2F/KFZDhbXfKy3heLyO5oL/83FpmsexdOD3e1fVAVOt8D/vUDqRldGUwcCB/tmUjG8ja/rK8VhWZJLI_2FgpjL3JGjDf/y3j6fQdBrh/DetapEtaWiNBwUHiM/pegbT4yrbhbT/LFjXxiBEZiL/frbuJho7lKd9yj/gPT8n8IP_2BtOBx8C4h3_/2BbEqrtNzThpLskj/93mfOGKf/O
unknown
—
—
malicious
5596
iexplore.exe
GET
404
49.13.77.253:80
http://extra.avareg.cn/webstore/YIN57ZHC4kyjwZBdnL9/EaZghlAXcWGHCLUHkIiNeK/Kkgif9hbnIn5j/JC_2BRXH/LEAXixX08fNuErLBtp4T5oe/M_2FEtODv1/_2Bvy7c_2FMnzlwkZ/xc52Q_2FMBN8/zx8kNfSbqAC/BJj7CcpxsBk2dg/LUhJMHtkglsyhhZP5XKv5/h932WlXKXWkGVfxF/82JwBeMPHX7Q0E9/zyngIybftzI/uAGAcSSv5/Cuf
unknown
—
—
malicious
5512
iexplore.exe
GET
404
49.13.77.253:80
http://ws.doter.at/webstore/TVg6E36LnUVvrq9Y/MLyL_2BIUnEtLdY/cTbnS_2FlptA_2Bn6v/6i6aroG7U/Em5mzqBgLxk4eMC5mzQM/QXP2qIJ7PNoK_2BbPEg/X2SD_2BppYbUtS9qZjMwDv/m9rUw_2BhZdHd/Pr0Uq0iT/u6aGRVA_2FU1IQGuCuoQWKB/vcwaq_2Bbi/ytx1UKse9NFHV8_2B/fbDtzHr2y5Sd/gAklTPTXPkZ/tK6XFX06oO3wYO/CqRbi
unknown
—
—
malicious
4736
iexplore.exe
GET
404
49.13.77.253:80
http://f1.cnboal.at/webstore/3uPccV1GTu/sF0xa9OAvuRWZ0X76/fSRqfJ3RQ40h/Sjai6LDKyFv/MJ_2FLbA60B_2B/m_2Bp7BpS5LnakYhh0C2y/PAkRWhfNdKRee2EF/_2BTLbOKJgtotOB/GpLDrwigPSbxp8Xj4b/PqdiYa1qX/k9o8jt_2F9l2_2B89Yed/pV5W0SqDcuXCRnPnBYu/hwrBgZgXvIWtpuK_2B2wAf/1NIhUv_2FDpT7/0UPRvaODTxip/D
unknown
—
—
malicious
1020
iexplore.exe
GET
404
49.13.77.253:80
http://op.iovbased.at/webstore/JTEGa7YMOceuE/sxZIjBZB/J7NrvfBOZU_2BzFskoQTSk9/8Ax6ZKClup/JDchuu5bEDu14_2FH/PzxaMFsykueK/mNk32nM84Sm/_2F2wYhSzVhG_2/B4aAFHxOwofIHpMgG7yVD/7NtCFAmR_2BI0u_2/BZyWhExfg6qF79O/_2BYzDAjp8gz2crXWX/rmqjN4xru/xvUEFzQsvZ6eaSZ2qrZX/qhihI9uK5B/a6m1FXc2/FvM
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1164
iexplore.exe
49.13.77.253:80
api2.doter.at
Hetzner Online GmbH
DE
malicious
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 172.217.16.206
whitelisted
api2.doter.at
  • 49.13.77.253
malicious
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.0
  • 40.126.31.130
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.71
  • 40.126.31.69
  • 40.126.31.128
whitelisted
arc.msn.com
  • 20.199.58.43
  • 20.74.47.205
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
  • 2a01:111:f100:a000::4134:4847
whitelisted
15.164.165.52.in-addr.arpa
  • —
unknown
7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
1164
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
1164
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
6148
2018-12-13-Ursnif-retreived-by-Hancitor-infected-host.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
6344
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
616
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2432
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5596
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5596
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2796
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
1020
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2018-12-13-Ursnif-retreived-by-Hancitor-infected-host.exe