We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
14 October 2021, 12:33
Analysis environment:
Windows 7 Pro, build 7601, x86
https://znpst.top/dl/build2.exe
MD5:
59CE11AAC4E8243045B32D54BCCE8E79
SHA1:
68003F50B342FF64883E197EA6685E343CEC4257
SHA256:
CD6BF2F554A9AA446CB36D28E374E1010268CBDA8F55EB0043FBE6E2724128BE
Analysis result
Threat level:
Malicious activity
Tags:
trojan
gozi
ursnif
dreambot
Full analysis:
Analysis https://znpst.top/dl/build2.exe Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Connects to CnC server
iexplore.exe (PID: 2424)
URSNIF was detected
iexplore.exe (PID: 2424)
SUSPICIOUS
Reads Microsoft Outlook installation path
iexplore.exe (PID: 2424)
iexplore.exe (PID: 3776)
INFO
Reads the computer name
iexplore.exe (PID: 408)
iexplore.exe (PID: 2424)
iexplore.exe (PID: 3776)
Checks supported languages
iexplore.exe (PID: 408)
iexplore.exe (PID: 2424)
iexplore.exe (PID: 3776)
Changes internet zones settings
iexplore.exe (PID: 408)
Application launched itself
iexplore.exe (PID: 408)
Reads settings of System Certificates
iexplore.exe (PID: 408)
iexplore.exe (PID: 2424)
Checks Windows Trust Settings
iexplore.exe (PID: 2424)
iexplore.exe (PID: 408)
Reads internet explorer settings
iexplore.exe (PID: 2424)
iexplore.exe (PID: 3776)
Creates files in the user directory
iexplore.exe (PID: 408)
Changes settings of System certificates
iexplore.exe (PID: 408)
Adds / modifies Windows certificates
iexplore.exe (PID: 408)
Threats
PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile