File name:

2018-11-27-Ursnif-malware-binary.exe

Full analysis: https://app.any.run/tasks/576566e1-4356-49fc-a492-766f873de1a2
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 10:59:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

961D559E9AAA58534CC8331A1F8094AE

SHA1:

946B241758216ED34793DE0512C54EFA0D629918

SHA256:

AAA41C27D5B4A160ED2A00BA820DD6ADA86ED80E76D476A8379543478E608F84

SSDEEP:

6144:7ebQQ1cgEeqcXNdJezDxhqJTsXAl7pzUyf0YFC5TRTywiKcPYFnTW:7eM3c9CzzUT0Al7pzUy/FCncPYFnT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 4608)
      • iexplore.exe (PID: 5556)
      • iexplore.exe (PID: 6752)
      • iexplore.exe (PID: 4336)
      • iexplore.exe (PID: 4696)
      • iexplore.exe (PID: 5204)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 904)

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 4608)
      • iexplore.exe (PID: 5556)
      • iexplore.exe (PID: 6752)
      • iexplore.exe (PID: 4336)
      • iexplore.exe (PID: 4696)
      • iexplore.exe (PID: 5204)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 904)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 5556)
      • iexplore.exe (PID: 6752)
      • iexplore.exe (PID: 4608)
      • iexplore.exe (PID: 4336)
      • iexplore.exe (PID: 4696)
      • iexplore.exe (PID: 5204)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 904)

  • INFO

    • Reads the computer name

      • 2018-11-27-Ursnif-malware-binary.exe (PID: 5132)
      • ielowutil.exe (PID: 4040)

    • The sample compiled with english language support

      • 2018-11-27-Ursnif-malware-binary.exe (PID: 5132)

    • Checks supported languages

      • 2018-11-27-Ursnif-malware-binary.exe (PID: 5132)
      • ielowutil.exe (PID: 4040)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 4976)

    • Reads the software policy settings

      • slui.exe (PID: 7084)
      • slui.exe (PID: 7048)

    • Checks proxy server information

      • slui.exe (PID: 7048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:11:27 11:25:17+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 205312
InitializedDataSize: 114688
UninitializedDataSize: -
EntryPoint: 0x34d7
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 7.3.75.85
ProductVersionNumber: 7.3.75.85
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Substantial Salt
ProductVersion: 7.3.75.85
LegalCopyright: Copyright © 2001 Substantial Salt. All rights reserved
FileDescription: Landmile
OriginalFileName: sawwhole.exe
FileVersion: 7.3.75.85
InternalName: Landmile
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
32
Malicious processes
12
Suspicious processes
6

Behavior graph

Click at the process to see the details
start 2018-11-27-ursnif-malware-binary.exe no specs sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
904"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4200 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1348"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1388"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4608 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1660"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2152"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2268"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4976 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2316"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5256 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2316"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6404 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
43 774
Read events
43 460
Write events
260
Delete events
54

Modification events

(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{239AFD7F-089F-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
Executable files
0
Suspicious files
54
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2268iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
2268iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:831450039390A441C63603FFB07C868C
SHA256:FB956CC4793CB2657B3096CD1EC5E54D2D35B46B2234A3CF702E9D292F53C39D
4976iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFACB156C695969CEC.TMPbinary
MD5:2AE142A3106A263DE0CFBEE92F63D167
SHA256:479BFA071DF8C0414717BA5D58AD1373B7BAD0A206843348F87E4C6CD3408A6A
5256iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFDA2D61CD178A43E8.TMPbinary
MD5:90852D1F9CA329FEC3D78E465EB5E1CD
SHA256:FFEA5330C79C3D91BED039AFD6AA3F087CCDAE5906957379D95C6488A5069C21
4976iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{239AFD7F-089F-11F0-B4ED-18F7786F96EE}.datbinary
MD5:A9B9E35AD36EDA83A18BBD74F8DE047E
SHA256:CCE6B6E1C5B709EA9BEF5912D4E2F893D9F4BC7EE8AE549BCEAB9DE6EE873101
1348iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{56CC8193-089F-11F0-B4ED-18F7786F96EE}.datbinary
MD5:2E15724C7160EB8126B3932BE5EA6D82
SHA256:2F54877096A9A0ADEFEF63442636746116A39BB00090A5EE57E367AB178ACFDC
5256iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{3CED30FA-089F-11F0-B4ED-18F7786F96EE}.datbinary
MD5:ECB7020C1FE058B22A5B7269DE0EB8F0
SHA256:EB1FE256793BE0FA8C8EED844F6E4DC1188983E88960078D03FC851CC9115E10
5256iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFEA2E444F3339B037.TMPbinary
MD5:AC4D8B4317D10EF8BBF3D2D290321BCA
SHA256:1B391D4CFF6DDFC7248E29F58D17A835D4D052F7F18DF7E04F42E864A198EC72
6248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{49E1A358-089F-11F0-B4ED-18F7786F96EE}.datbinary
MD5:3692E39EF8364544ED8F74F13F036160
SHA256:52C67A4F71B5B507277243919091C8D8E6475A6570F40B10820CE4BDF1FE1149
1348iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFBAA1769E3E53DB3A.TMPbinary
MD5:7F165DCC42BC2D317781553F9C875E5B
SHA256:5D58C10C9F0C92DC769530A148EF8E2AD489C5985740CDD56D6704423BD62D00
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
88
DNS requests
23
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2268
iexplore.exe
GET
404
49.13.77.253:80
http://cochrimato.com/images/ngj9cRLX_/2BZm0C5zXK62HCU4s0hV/6pL2_2FhMdIPxRYEAtb/poNPkqZyEwfRS0fcbhc_2B/dtOSSe2_2BqT5/hr_2BEyB/qsDw3BPAcjqiZs27CyrF1zL/zn2Jottlc4/fGQJzxmyhqtYCHlx9/rnEc9OvS/qonLbbq2r/iq.avi
unknown
—
—
malicious
2316
iexplore.exe
GET
404
49.13.77.253:80
http://alogencian.com/images/NRKAqmnNA4XZsf/Xicc5lfdhJJyIDH9sqfVH/45oEy1kzHSkY6ynr/Yy2gH_2FcSP5cHE/QDwMAQeQCGtbpTd5Bs/_2Fqpx0Fx/chnG0C2uSroHl9uR72JV/SqrUlA_2BtsSKumA_2F/Eq7Y2FijeJJfTid9PQ8Zv8/lIns.avi
unknown
—
—
malicious
4608
iexplore.exe
GET
404
49.13.77.253:80
http://cochrimato.com/images/pHdWS7muBYuvG3_/2FphUZf_2FgBI3_2FD/FgLKLdvUh/96uU7r0O1mB5TK4bw_2B/XVWVeLxfMgu2LPgkew7/1VoT_2BrNHG75swHnFF2B6/ocNJeqrOzSGXV/726z66Rc/jSHM0Mv7F9KoApHeSdVYuxS/PdoSgIYUdw/7lvFQZE87lIcQ9Ddb/xKKGQFu.avi
unknown
—
—
malicious
5556
iexplore.exe
GET
404
49.13.77.253:80
http://dinagetter.com/images/mEXtyts7nI/uLqfg79_2BlK84sye/7nGG5cWVHXsK/zEAvYUHbhgi/sC3cHi0i94oI8z/1tSGkArZMdVCeTtzcr9cA/dT5fZ_2BaInrtqUu/TMzOM9eYIexkNoU/lK0EGfwYuD0GxqcSwb/zNIUfUaT5/K46OApXDT2dhoA4skjED/P0AKS_2BO2A/qG6.avi
unknown
—
—
malicious
6752
iexplore.exe
GET
404
49.13.77.253:80
http://alogencian.com/images/1y_2Bs_2Fs1b/NwT50AOml2U/_2Bf4QZnaGmq_2/BZS6MoFHdJ4XmuCCADauu/RqIPrnPGSGVye_2F/Bo8fOLND14zJ5zD/O_2F_2BWayHu_2Bz_2/BYufp4SKD/umopIgN4u_2B79PQ4EUE/3D_2BNq9jR5QwfdueTi/e9xkRx61_2BY5vRxH/mh.avi
unknown
—
—
malicious
1388
iexplore.exe
GET
404
49.13.77.253:80
http://cochrimato.com/images/x4oiNE4elHa1S6N/k8wnTcOB02uSMgJxub/IQR5vFka7/cuPIjNy2Z1XBcRU0FDic/tDvJe70UqN5Fy_2FpQg/Q0zLp_2Byef2TqL8VDn11c/pCXNt_2F7nFPe/bkgOjp5h/whbNbHQ4h50WpGHPsMuP35J/0BaHvhj9/v.avi
unknown
—
—
malicious
7048
iexplore.exe
GET
404
49.13.77.253:80
http://alogencian.com/images/eC2bpdwj/81o3gWJV9PpP1d_2B0whzb1/yDgIYY0nlN/SO54HMlWMexqaMtVS/8akJBePoJSB_/2Bcohn4BqdJ/rRsurLreqVz1wo/RtNZ2H2DO1XwCFSiMSaqd/aAonLz3VgcuvgZUZ/GvtdB5iAc4lQC5k/Qa5agkBxc0eKYFY7Q0/eT0u7UATj/I.avi
unknown
—
—
malicious
5204
iexplore.exe
GET
404
49.13.77.253:80
http://alogencian.com/images/JFZugHGT1Uiej6m6Mai3/0IgwdiFI5HYPC74tDvz/1Zh7WJiE6O3JGjU4ebxNwn/yqPO_2Fg_2BDk/Q7IKQWpb/mTdYahEI8jfpY9UL6KYRyss/YojRmeeOlD/nqBdXyc2JE3KgRLgu/B_2FSKP_2FZE/YSqIFiaoT/B8m8h.avi
unknown
—
—
malicious
4696
iexplore.exe
GET
404
49.13.77.253:80
http://dinagetter.com/images/eupd1fD6o4b/eJZr0ORfX675Gd/NieK7gK6Iglx_2FdCpfUr/u5eclOoYwuzxUpBO/QcQGYeBKu1W2TVf/K8SkHRv4y_2BJMfr_2/BnQAY5rBF/DZlcitj1pqYN9Wd_2BTv/7IZyGuH7Pr4KoA15VnG/rovnecdYdAGjFo/2.avi
unknown
—
—
malicious
4336
iexplore.exe
GET
404
49.13.77.253:80
http://cochrimato.com/images/ZcqqKmpCzm4vMDNB0prbe/nlzmyn7omQ4KM21l/rDtN6wEKZz4e_2B/XBk5EhKuAqbvSqM3Oe/MIgIGIlB4/KgLryijTs_2Bm65sEbxD/Y0DUvjR5JOgLCFuezN7/xVk5KkDflXTojFjmW3vToV/z_2F_2F6LMdtW/pyIHijeO/1kRdQejuTo5/XvS5gG2.avi
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2268
iexplore.exe
49.13.77.253:80
cochrimato.com
Hetzner Online GmbH
DE
malicious
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6392
backgroundTaskHost.exe
20.74.47.205:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.181.238
whitelisted
cochrimato.com
  • 49.13.77.253
malicious
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.130
  • 40.126.31.71
  • 20.190.159.131
  • 20.190.159.4
  • 20.190.159.128
  • 40.126.31.67
  • 20.190.159.68
whitelisted
arc.msn.com
  • 20.74.47.205
  • 20.223.35.26
whitelisted
iecvlist.microsoft.com
  • 52.239.160.33
whitelisted
c.urs.microsoft.com
  • 20.93.72.182
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
  • 2603:1030:800:5::bfee:a08d
whitelisted

Threats

PID
Process
Class
Message
5556
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
2316
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
4608
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5556
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6752
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6752
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
4336
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
4696
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5204
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2316
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2018-11-27-Ursnif-malware-binary.exe