File name:

2018-11-27-Ursnif-malware-binary.exe

Full analysis: https://app.any.run/tasks/576566e1-4356-49fc-a492-766f873de1a2
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 10:59:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

961D559E9AAA58534CC8331A1F8094AE

SHA1:

946B241758216ED34793DE0512C54EFA0D629918

SHA256:

AAA41C27D5B4A160ED2A00BA820DD6ADA86ED80E76D476A8379543478E608F84

SSDEEP:

6144:7ebQQ1cgEeqcXNdJezDxhqJTsXAl7pzUyf0YFC5TRTywiKcPYFnTW:7eM3c9CzzUT0Al7pzUy/FCncPYFnT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 4608)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 5556)
      • iexplore.exe (PID: 6752)
      • iexplore.exe (PID: 4336)
      • iexplore.exe (PID: 5204)
      • iexplore.exe (PID: 4696)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 904)

    • Connects to the CnC server

      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 5556)
      • iexplore.exe (PID: 4608)
      • iexplore.exe (PID: 6752)
      • iexplore.exe (PID: 4336)
      • iexplore.exe (PID: 4696)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 5204)
      • iexplore.exe (PID: 904)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 5556)
      • iexplore.exe (PID: 4608)
      • iexplore.exe (PID: 6752)
      • iexplore.exe (PID: 4336)
      • iexplore.exe (PID: 5204)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 4696)
      • iexplore.exe (PID: 904)

  • INFO

    • The sample compiled with english language support

      • 2018-11-27-Ursnif-malware-binary.exe (PID: 5132)

    • Checks supported languages

      • 2018-11-27-Ursnif-malware-binary.exe (PID: 5132)
      • ielowutil.exe (PID: 4040)

    • Reads the computer name

      • ielowutil.exe (PID: 4040)
      • 2018-11-27-Ursnif-malware-binary.exe (PID: 5132)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 4976)

    • Reads the software policy settings

      • slui.exe (PID: 7084)
      • slui.exe (PID: 7048)

    • Checks proxy server information

      • slui.exe (PID: 7048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:11:27 11:25:17+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 205312
InitializedDataSize: 114688
UninitializedDataSize: -
EntryPoint: 0x34d7
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 7.3.75.85
ProductVersionNumber: 7.3.75.85
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Substantial Salt
ProductVersion: 7.3.75.85
LegalCopyright: Copyright © 2001 Substantial Salt. All rights reserved
FileDescription: Landmile
OriginalFileName: sawwhole.exe
FileVersion: 7.3.75.85
InternalName: Landmile
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
32
Malicious processes
12
Suspicious processes
6

Behavior graph

Click at the process to see the details
start 2018-11-27-ursnif-malware-binary.exe no specs sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
904"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4200 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1348"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1388"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4608 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1660"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2152"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2268"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4976 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2316"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5256 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2316"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6404 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
43 774
Read events
43 460
Write events
260
Delete events
54

Modification events

(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{239AFD7F-089F-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(4976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
Executable files
0
Suspicious files
54
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2268iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
1348iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF2028558E9843D365.TMPbinary
MD5:A99F912709B9F5BA44761407BE6AC9D3
SHA256:DAAA4966E1946C8FF71C401A19DB07B34CC5115474749A8FA8803E6E17432692
4976iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFACB156C695969CEC.TMPbinary
MD5:2AE142A3106A263DE0CFBEE92F63D167
SHA256:479BFA071DF8C0414717BA5D58AD1373B7BAD0A206843348F87E4C6CD3408A6A
4976iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{239AFD7F-089F-11F0-B4ED-18F7786F96EE}.datbinary
MD5:A9B9E35AD36EDA83A18BBD74F8DE047E
SHA256:CCE6B6E1C5B709EA9BEF5912D4E2F893D9F4BC7EE8AE549BCEAB9DE6EE873101
2268iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:831450039390A441C63603FFB07C868C
SHA256:FB956CC4793CB2657B3096CD1EC5E54D2D35B46B2234A3CF702E9D292F53C39D
5256iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{3CED30FC-089F-11F0-B4ED-18F7786F96EE}.datbinary
MD5:63E59829E4FE9710B02003E54A0FB75D
SHA256:F753E3EE888B85A2FD81E809CF4FD5E6991FDBE0C8195EF71B0B8FDA6CCD6CE3
4976iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{239AFD81-089F-11F0-B4ED-18F7786F96EE}.datbinary
MD5:A8DA4C09A0201BC86AFD7E8D69D4942E
SHA256:4EB3AD9B6CD6C5B11914BCD621714DA0A4971F9DA8C23FEBF89B043CD0176DF2
3784iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF1AC851BE30D4BE91.TMPbinary
MD5:F2310D81461A0A4366BDDDB9BB2050C0
SHA256:50A943D340A2C538C618AD5841195EE41E75E8915D2A04E0DEA7B2E1E3C48FAA
4976iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF256305917412107C.TMPbinary
MD5:39C9F5DDCF0C9EE685201CC7FAE803D1
SHA256:2F1ED1274444D8FFE712C28B4E74FDCA4120402B4829FA912B5492BE794D55AD
5256iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFDA2D61CD178A43E8.TMPbinary
MD5:90852D1F9CA329FEC3D78E465EB5E1CD
SHA256:FFEA5330C79C3D91BED039AFD6AA3F087CCDAE5906957379D95C6488A5069C21
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
88
DNS requests
23
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2268
iexplore.exe
GET
404
49.13.77.253:80
http://cochrimato.com/images/ngj9cRLX_/2BZm0C5zXK62HCU4s0hV/6pL2_2FhMdIPxRYEAtb/poNPkqZyEwfRS0fcbhc_2B/dtOSSe2_2BqT5/hr_2BEyB/qsDw3BPAcjqiZs27CyrF1zL/zn2Jottlc4/fGQJzxmyhqtYCHlx9/rnEc9OvS/qonLbbq2r/iq.avi
unknown
—
—
malicious
2316
iexplore.exe
GET
404
49.13.77.253:80
http://alogencian.com/images/NRKAqmnNA4XZsf/Xicc5lfdhJJyIDH9sqfVH/45oEy1kzHSkY6ynr/Yy2gH_2FcSP5cHE/QDwMAQeQCGtbpTd5Bs/_2Fqpx0Fx/chnG0C2uSroHl9uR72JV/SqrUlA_2BtsSKumA_2F/Eq7Y2FijeJJfTid9PQ8Zv8/lIns.avi
unknown
—
—
malicious
5556
iexplore.exe
GET
404
49.13.77.253:80
http://dinagetter.com/images/mEXtyts7nI/uLqfg79_2BlK84sye/7nGG5cWVHXsK/zEAvYUHbhgi/sC3cHi0i94oI8z/1tSGkArZMdVCeTtzcr9cA/dT5fZ_2BaInrtqUu/TMzOM9eYIexkNoU/lK0EGfwYuD0GxqcSwb/zNIUfUaT5/K46OApXDT2dhoA4skjED/P0AKS_2BO2A/qG6.avi
unknown
—
—
malicious
4608
iexplore.exe
GET
404
49.13.77.253:80
http://cochrimato.com/images/pHdWS7muBYuvG3_/2FphUZf_2FgBI3_2FD/FgLKLdvUh/96uU7r0O1mB5TK4bw_2B/XVWVeLxfMgu2LPgkew7/1VoT_2BrNHG75swHnFF2B6/ocNJeqrOzSGXV/726z66Rc/jSHM0Mv7F9KoApHeSdVYuxS/PdoSgIYUdw/7lvFQZE87lIcQ9Ddb/xKKGQFu.avi
unknown
—
—
malicious
6752
iexplore.exe
GET
404
49.13.77.253:80
http://alogencian.com/images/1y_2Bs_2Fs1b/NwT50AOml2U/_2Bf4QZnaGmq_2/BZS6MoFHdJ4XmuCCADauu/RqIPrnPGSGVye_2F/Bo8fOLND14zJ5zD/O_2F_2BWayHu_2Bz_2/BYufp4SKD/umopIgN4u_2B79PQ4EUE/3D_2BNq9jR5QwfdueTi/e9xkRx61_2BY5vRxH/mh.avi
unknown
—
—
malicious
1388
iexplore.exe
GET
404
49.13.77.253:80
http://cochrimato.com/images/x4oiNE4elHa1S6N/k8wnTcOB02uSMgJxub/IQR5vFka7/cuPIjNy2Z1XBcRU0FDic/tDvJe70UqN5Fy_2FpQg/Q0zLp_2Byef2TqL8VDn11c/pCXNt_2F7nFPe/bkgOjp5h/whbNbHQ4h50WpGHPsMuP35J/0BaHvhj9/v.avi
unknown
—
—
malicious
6512
iexplore.exe
GET
404
49.13.77.253:80
http://dinagetter.com/images/ueNRVFEwjUVE/ZlNuVlQKRjD/BRnXnhHLWg4RMM/GvNtMPk92SzzPrBjYjHn7/sbnnYWpJUYqYiUyu/lLo59JrCQgZAoqU/YeYhHx3zuK4AGktrED/V5RLXqDye/Lnrn9_2FFMhFXSsDXHbU/mCiJAvA6q52zOqyE1M4/Yama9bBoHgAsNy/EpJO.avi
unknown
—
—
unknown
7048
iexplore.exe
GET
404
49.13.77.253:80
http://alogencian.com/images/eC2bpdwj/81o3gWJV9PpP1d_2B0whzb1/yDgIYY0nlN/SO54HMlWMexqaMtVS/8akJBePoJSB_/2Bcohn4BqdJ/rRsurLreqVz1wo/RtNZ2H2DO1XwCFSiMSaqd/aAonLz3VgcuvgZUZ/GvtdB5iAc4lQC5k/Qa5agkBxc0eKYFY7Q0/eT0u7UATj/I.avi
unknown
—
—
malicious
4336
iexplore.exe
GET
404
49.13.77.253:80
http://cochrimato.com/images/ZcqqKmpCzm4vMDNB0prbe/nlzmyn7omQ4KM21l/rDtN6wEKZz4e_2B/XBk5EhKuAqbvSqM3Oe/MIgIGIlB4/KgLryijTs_2Bm65sEbxD/Y0DUvjR5JOgLCFuezN7/xVk5KkDflXTojFjmW3vToV/z_2F_2F6LMdtW/pyIHijeO/1kRdQejuTo5/XvS5gG2.avi
unknown
—
—
malicious
4696
iexplore.exe
GET
404
49.13.77.253:80
http://dinagetter.com/images/eupd1fD6o4b/eJZr0ORfX675Gd/NieK7gK6Iglx_2FdCpfUr/u5eclOoYwuzxUpBO/QcQGYeBKu1W2TVf/K8SkHRv4y_2BJMfr_2/BnQAY5rBF/DZlcitj1pqYN9Wd_2BTv/7IZyGuH7Pr4KoA15VnG/rovnecdYdAGjFo/2.avi
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2268
iexplore.exe
49.13.77.253:80
cochrimato.com
Hetzner Online GmbH
DE
malicious
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6392
backgroundTaskHost.exe
20.74.47.205:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.181.238
whitelisted
cochrimato.com
  • 49.13.77.253
malicious
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.130
  • 40.126.31.71
  • 20.190.159.131
  • 20.190.159.4
  • 20.190.159.128
  • 40.126.31.67
  • 20.190.159.68
whitelisted
arc.msn.com
  • 20.74.47.205
  • 20.223.35.26
whitelisted
iecvlist.microsoft.com
  • 52.239.160.33
whitelisted
c.urs.microsoft.com
  • 20.93.72.182
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
  • 2603:1030:800:5::bfee:a08d
whitelisted

Threats

PID
Process
Class
Message
5556
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
2316
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
4608
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5556
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6752
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6752
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
4336
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
4696
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5204
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2316
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2018-11-27-Ursnif-malware-binary.exe