analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://znpst.top/dl/build2.exe

Full analysis: https://app.any.run/tasks/152e55c2-5e8f-4fe2-a764-7876ba00f03e
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: October 14, 2021, 12:33:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
gozi
ursnif
dreambot
Indicators:
MD5:

59CE11AAC4E8243045B32D54BCCE8E79

SHA1:

68003F50B342FF64883E197EA6685E343CEC4257

SHA256:

CD6BF2F554A9AA446CB36D28E374E1010268CBDA8F55EB0043FBE6E2724128BE

SSDEEP:

3:N8HMsYMMdAn:2HfhcAn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to CnC server

      • iexplore.exe (PID: 2424)

    • URSNIF was detected

      • iexplore.exe (PID: 2424)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2424)
      • iexplore.exe (PID: 3776)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 408)
      • iexplore.exe (PID: 2424)
      • iexplore.exe (PID: 3776)

    • Reads the computer name

      • iexplore.exe (PID: 408)
      • iexplore.exe (PID: 2424)
      • iexplore.exe (PID: 3776)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2424)
      • iexplore.exe (PID: 408)

    • Changes settings of System certificates

      • iexplore.exe (PID: 408)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2424)
      • iexplore.exe (PID: 3776)

    • Changes internet zones settings

      • iexplore.exe (PID: 408)

    • Creates files in the user directory

      • iexplore.exe (PID: 408)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 408)
      • iexplore.exe (PID: 2424)

    • Application launched itself

      • iexplore.exe (PID: 408)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe #URSNIF iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
408"C:\Program Files\Internet Explorer\iexplore.exe" "https://znpst.top/dl/build2.exe"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2424"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:408 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3776"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:408 CREDAT:3085596 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
17 698
Read events
17 539
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
11
Text files
12
Unknown types
6

Dropped files

PID
Process
Filename
Type
2424iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:FE76AA992BBF91142974F286922E47A1
SHA256:C38FBDE0C462A835969DAE85D33D450BB335F35D5C43331DCD8EED27D54C7F5E
408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8Fder
MD5:4D46F24ED60DC735D8E389EB5FF647C0
SHA256:B3BB1C9980CCAA41D82FDB8C5B1B292853A43AE2B682F47AEE9B544969622BE7
2424iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar5912.tmpcat
MD5:E9E21888D1DC2348DEE343980E7188FA
SHA256:3D249DB46B4BD1CFAE8F56B272F7116B218AC9D64225D1109751EE487FA9F3AE
2424iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:68C5B502B401F309A9A94015FDE32314
SHA256:3888E2978FC64A6EA43706AE4A79399CD1EF0BA16A1BC8E93A3648DC75360790
408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8Fbinary
MD5:C10842B54E39A0211EE62A391096AD0F
SHA256:4811D2064EF7221A9D530E08157E9E52FD9016E117323E25158475F10D1C1604
2424iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab5911.tmpcompressed
MD5:AB5C36D10261C173C5896F3478CDC6B7
SHA256:F8E90FB0557FE49D7702CFB506312AC0B24C97802F9C782696DB6D47F434E8E9
408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:88300288F51B8732555EBE88E99A1E1A
SHA256:1D68CDFB0CC48EAB72D8C845C2E409DD0A4D9BF593F9C1C6765C941987353EB0
408iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\1ALR3XE8.txttext
MD5:5FE303D314D7319BEE74C249EB66FD20
SHA256:1DDD68414A2F71A16C89EA31D9B15F0C9C6B1A4FB5D922F2F5F697ADC07BBA7D
408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:82FA88E64877AFB41DCA1C1538103AD6
SHA256:07BC4A1CB38272DC95952E6173FC9ADC1CFEA603C8CD5A0C9246564647437A8F
408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:9EFB20EF76ED7608CEAA660727116B2C
SHA256:3254411B1AE9B47703AC27829AC9F01FC7B6EDAF974F1EC24261173FC362AB02
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
38
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
408
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.68 Kb
whitelisted
408
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
408
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
2424
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?8a39714b8b3f960a
US
compressed
59.7 Kb
whitelisted
408
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2424
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?27b1cbd9aeebdc65
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
408
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
408
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
Microsoft Corporation
GB
whitelisted
—
—
210.182.29.70:443
znpst.top
LG DACOM Corporation
KR
malicious
2424
iexplore.exe
210.182.29.70:443
znpst.top
LG DACOM Corporation
KR
malicious
2424
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1936
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
Microsoft Corporation
GB
whitelisted
408
iexplore.exe
131.253.33.203:443
www.msn.com
Microsoft Corporation
US
whitelisted
—
—
104.111.242.51:443
go.microsoft.com
Akamai International B.V.
NL
unknown
408
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
znpst.top
  • 210.182.29.70
  • 211.169.6.249
  • 92.62.104.245
  • 190.9.216.98
  • 1.248.122.240
  • 121.136.102.4
  • 151.251.30.69
  • 187.232.203.159
  • 211.168.197.211
  • 211.59.14.90
malicious
api.bing.com
  • 13.107.5.80
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
12 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://znpst.top/dl/build2.exe