File name:

2019-01-16-Ursnif-retrieved-by-Hancitor-infected-host.exe

Full analysis: https://app.any.run/tasks/345d54d3-7781-43e8-95ed-b6863c55f1b9
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 03:06:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

9B839D38EFB45672CDD6CA13F682F487

SHA1:

0C45D7E0EDAC07BC3F728E883D5DF59DC9B9370C

SHA256:

D31F2993EC21C24064CE1F2987E10BFE271103880777B476C0D1812423C1C4B0

SSDEEP:

6144:lPxvTnVSmY1ZUb2wklOhSIeGrWjjjjjZjjjjjjjjjjjtffx9:xlnsmYXUb2waOhSIyjjjjjZjjjjjjjj3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 7964)
      • iexplore.exe (PID: 616)
      • iexplore.exe (PID: 6592)
      • iexplore.exe (PID: 684)
      • iexplore.exe (PID: 664)
      • iexplore.exe (PID: 6576)
      • iexplore.exe (PID: 5812)
      • iexplore.exe (PID: 5936)
      • iexplore.exe (PID: 7952)
      • iexplore.exe (PID: 5112)
      • iexplore.exe (PID: 5204)

    • Connects to the CnC server

      • iexplore.exe (PID: 7964)
      • iexplore.exe (PID: 616)
      • iexplore.exe (PID: 6592)
      • iexplore.exe (PID: 5936)
      • iexplore.exe (PID: 684)
      • iexplore.exe (PID: 664)
      • iexplore.exe (PID: 5812)
      • iexplore.exe (PID: 6576)
      • iexplore.exe (PID: 7952)
      • iexplore.exe (PID: 5112)
      • iexplore.exe (PID: 5204)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 7964)
      • iexplore.exe (PID: 616)
      • iexplore.exe (PID: 6592)
      • iexplore.exe (PID: 664)
      • iexplore.exe (PID: 6576)
      • iexplore.exe (PID: 5812)
      • iexplore.exe (PID: 5936)
      • iexplore.exe (PID: 684)
      • iexplore.exe (PID: 7952)
      • iexplore.exe (PID: 5112)
      • iexplore.exe (PID: 5204)

  • INFO

    • Checks supported languages

      • 2019-01-16-Ursnif-retrieved-by-Hancitor-infected-host.exe (PID: 7304)
      • ielowutil.exe (PID: 7880)

    • Reads the computer name

      • 2019-01-16-Ursnif-retrieved-by-Hancitor-infected-host.exe (PID: 7304)
      • ielowutil.exe (PID: 7880)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 7912)

    • Reads the software policy settings

      • slui.exe (PID: 7388)
      • slui.exe (PID: 1616)

    • Checks proxy server information

      • slui.exe (PID: 1616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:02:20 09:52:32+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 110080
InitializedDataSize: 128000
UninitializedDataSize: -
EntryPoint: 0x4dc5
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x004f
FileFlags: (none)
FileOS: Unknown (0x40534)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (457A)
CharacterSet: Unknown (A56B)
InternalName: cejegibil.exe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
31
Malicious processes
17
Suspicious processes
4

Behavior graph

Click at the process to see the details
start 2019-01-16-ursnif-retrieved-by-hancitor-infected-host.exe sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7536 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
664"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7512 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
684"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1764 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1272"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1600"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5728 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1616C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1764"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2240"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5048"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5112"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7268 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
46 779
Read events
46 465
Write events
260
Delete events
54

Modification events

(PID) Process:(7912) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(7912) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(7912) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{2884E22F-0926-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(7912) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(7912) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7912) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7912) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7912) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(7912) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
(PID) Process:(7964) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Content
Operation:writeName:CachePrefix
Value:
Executable files
0
Suspicious files
54
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{41C1029E-0926-11F0-B4ED-18F7786F96EE}.datbinary
MD5:E7E796D7825D54EAF9BF9863167DC18B
SHA256:3C745032A1C523479BB9C113B97BD34C18F5B9392992418DD562C8CF95225331
7536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{41C1029C-0926-11F0-B4ED-18F7786F96EE}.datbinary
MD5:396A4D59C4892E047A63E394067D8509
SHA256:F5C59DE1CD699D65A8F9DC3291F1E31400E7162AA4FDA9043CAE437001C4985F
5048iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{5B7EE5C3-0926-11F0-B4ED-18F7786F96EE}.datbinary
MD5:49F0502FEF239B55EF158238BC0F06A1
SHA256:45E797621340078EFF1BBD16E0D61BB89AC7509622EDCD82982FED5007336A8E
7912iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{2884E231-0926-11F0-B4ED-18F7786F96EE}.datbinary
MD5:F318BDA3E8111CE73ADEFCD21CF97987
SHA256:053E36541B6C60C40ED3A629143ACC66936F1F37E29240A1FC93AB80D3C02FA9
2240iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{4E9D9711-0926-11F0-B4ED-18F7786F96EE}.datbinary
MD5:85F836ADFD3F65BAA88E51765748322F
SHA256:9021235DCA6AB4097AA6A00C182A18B3CF14D61DBDF5F01B519F49FF66A35E47
7912iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{2884E22F-0926-11F0-B4ED-18F7786F96EE}.datbinary
MD5:8C241794CC422E11B2D861F447481881
SHA256:FDE045984319BDF14831E682801894A421D2104648440D501EABE9D21CF0A591
7536iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFF18A414BE1A9DA98.TMPbinary
MD5:C1F24D12A0241329E186B7D6EB70D83F
SHA256:ACD833620B897BE39A2C174E81E0D1F7026298FBF8ADAE105440B05B8C11D4C8
7912iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFDDD8F57EBDC0CA45.TMPbinary
MD5:718A93B5448A86C6BAA1231970683A1B
SHA256:14F7DEFBF07DEB4CD8FCA416338A3D066C2CEBECF1ABAD666B059E321A1E66E1
5048iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFC7BAB46B9BFD70D7.TMPbinary
MD5:74307EFF8E63EBC4D7BC998305D77E1E
SHA256:3E8305C0BAFF0C11248779A8C6D3D48FEE2D07C3AA494C7533346FBBAB5F74D3
2240iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{4E9D9713-0926-11F0-B4ED-18F7786F96EE}.datbinary
MD5:8251DF1A68414BF919EAA5E9BA20EBEF
SHA256:4D59FE357AAF9F2CEC1DC21B60184C347D88AF2E47352F6FDB5C5FFEA60E3A46
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
92
DNS requests
37
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6592
iexplore.exe
GET
404
49.13.77.253:80
http://ax.ikobut.at/webstore/7Drj7K_2FAKHrq20R12/GbKGnMhfD5VeC270TffK5Z/wKQAxizVAxKB1/DsK5sAC2/wQScX1s3D8OzPrghnKZENOm/CdFyTJewZ6/jFTSpWwxLXJuSCigW/W4XnVro4kBd2/ynD0JoSEj7u/PDxHDHyRnwkRg7/hQMIz4HhgdLCaJUA6xv7p/qk6S_2B7sxNRGr3X/AD2XvUW2Ecp1pNw/tJ8adUup_2Bs/iY85s1c
unknown
—
—
malicious
684
iexplore.exe
GET
404
49.13.77.253:80
http://extra.avareg.cn/webstore/748WYVclAff/iqKcHXLU85mg8_/2Fa_2Bjcrzly8V8WXbyvL/mbw7hsmcaXQsVuPA/5FLOka7tsq02C9B/zfB_2F8RWwAB2rQE4M/gqtxgASZ8/BWSBxSe3fOYTjF2UC_2F/IEL08ubZbbvkfDN_2BC/H9FaZeHEIVaj7l1grkW_2F/FgkPWhSvLpvbC/pnLvdWr1/PvD8BtryYDevdIkNpK47jsn/wCc3_2BQFG/gsZMx3_2FWt99OEel/huJQHfTuNh/Efbak
unknown
—
—
malicious
5936
iexplore.exe
GET
404
49.13.77.253:80
http://sm.dvloop.at/webstore/43O4A5PIurU5RtRXWaGP25/bSFPidPzlacy3/6btIEPoC/TAjKWlzFAmisqCIXgf04YWT/LNRQpRDsni/iSIJoJbfKCkYp0wHN/z8SHvB3H_2Fl/1UkiA2Q6GH9/6ie_2BzLhnAtBi/gWmAs2ZZbHfTupwqzUhOU/x4uv2tdQUWhKXW2D/UW_2FAQldSFNK0K/r_2FCMjisvW2siUgD9/Deh6EhFR3957l26/xhuRgUO
unknown
—
—
malicious
616
iexplore.exe
GET
404
49.13.77.253:80
http://in.termas.at/webstore/Iq31ZEKaMN0fU8_2B8B/93MM1Vuk_2BctKLMbYmv2x/OIzAhl10Ies9y/07GdfZrC/lCpEvrbkxpmx4LJ6gNt0ins/CGNZ5C_2FX/0gkWOsp7Td7WpwPT_/2FsqWJ9nEwFN/_2B8iS21yIx/LBEYWr1QN0mF04/0MzV45rYm6Q0Nq0_2FMCC/acYTJ7TZlKMiInnf/0v4GeMjluDcFp_2/FIOmQoj4LpYyzvNShH/IDpumbpm/2
unknown
—
—
malicious
664
iexplore.exe
GET
404
49.13.77.253:80
http://foo.avaregio.at/webstore/3AAfCJKKI7F4344ven/y0cR9Atq5/BPxxnNjjgslNt8yJ0WmW/5ZDuahc7ztYpCzt1FDh/aCnzUrHlBGjhd3UBm_2Bem/zW0Dmyn_2FOuC/ddJoiZTq/6Cw_2FwVvoUVsbjWVhzLvDo/HgpcUNhiVT/6eAMriZQSb_2BThg3/6400edlYS6E7/vZGiRQ9DM1j/NGDegoRR0Qyfgn/AFHFhZuCVOZ0bODBgupeJ/l_2FRLUVJ28y6dlI/d3yz5rf2KoP/i
unknown
—
—
malicious
6576
iexplore.exe
GET
404
49.13.77.253:80
http://f1.cnboal.at/webstore/r9YTgJUVOUAV_/2B0hbj00/yRc8r4gAIeaAlXca46otzv6/1pXiG2FF6H/L2d5kkkOQYPuLtfOk/gv8wZaVp_2BU/iLj4flvmyRc/GFhuhNoKwddaPz/YCcxxz_2BHcZfLVbfQ43x/i_2FRqfl31nqrfpC/Uv4kz8hCRrgeC4S/wDLoI9G03_2F2vwDat/fgxXZeekr/vPT3m5VLm_2FyjMOYRMb/EdPYg2NMDtq2/VBBMUIB
unknown
—
—
malicious
1600
iexplore.exe
GET
404
49.13.77.253:80
http://api.ex100p.at/webstore/DP1GzQto/dMNKL5LxD6JW5L13PYQoJeD/69sojxmeDh/pGsg2JlSZEDzgHeck/VBTnaMAU1o6x/grwjHcRUbwI/_2F9F5NfMurcNR/kqEATjHPx4w1OVEHI8hL7/GPOq09XnKpTMEJHS/mrBXMPBPqZIJq_2/BBjQuOZGfbrLI_2BZ0/kveVUnsGp/teHUaZhl1Kyxwpof5tv5/fazfZ4snhBKUszd0XTR/UXRY16h
unknown
—
—
unknown
5812
iexplore.exe
GET
404
49.13.77.253:80
http://xxx.lapoder.at/webstore/E171WZ4NjsYgD/vqWSRt_2/Bjf0zD6exT5svB4RoMwzJ2G/fyLVsbtqjC/d_2Fo_2F_2BwI8rXp/Sa09SCett2ra/EPM6OukwQ6x/niB_2FJeq5FmDT/IAguqrPDey4W8wuQRQycV/UEhUn_2BPyt0pzQQ/uXMfq_2BMwpk19n/XyE9qWYimRMOmKmcXx/G1enMEUyk/2aH2GKFJivF07fZMeKij/Y_2BKxP4my7nqsWW0kz/dIkdykdipzMfDmV6Tvf8O6/J6e
unknown
—
—
malicious
7712
iexplore.exe
GET
404
49.13.77.253:80
http://op.basedok.at/webstore/MXylBxi7sAk/1Iye9PIVcR860s/WQ7pPxszHU1pi9448mnOL/bNv07xiyVNgQ6pKT/1jlih9OzX4iFoX7/gSCNxywHzstFk2rall/4GBQMT_2F/W0ySUrwVK7p0mEfPZzqD/HmkfXfuMeny6TXUf0h1/BpnhbpbfjtRon1L_2Fv2ka/flRScbMt29Vxg/ycdwTrjh/gRZ06WUmiHkab3R5xE49hTi/fmzmIONX/4
unknown
—
—
unknown
5112
iexplore.exe
GET
404
49.13.77.253:80
http://core.cnboal.at/webstore/W0_2FeCmIvU2Adh53qOaz/klIVAOa5IRM2aZuj/dOBUA7T8XTv0JqB/3y5F6O54r_2FC0KIzv/zsCxJwHdT/S3m3sZKIKQO_2Bk_2BLK/ZsB8_2F_2FPujI4W14d/wY5qYHSa0yD_2Bu4ZrnXsI/GfnrxGBhaKkc6/clzWTUfA/4OJYy9WdDRBKP_2FU01QwaV/i1sia8jDak/kHk8VpLZ78oudkw67/Z_2FI0WKYLyIgda3HmbR/X
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7964
iexplore.exe
49.13.77.253:80
g2.ex100p.at
Hetzner Online GmbH
DE
malicious
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
g2.ex100p.at
  • 49.13.77.253
malicious
client.wns.windows.com
  • 40.115.3.253
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.67
  • 40.126.32.140
  • 20.190.160.14
  • 20.190.160.2
  • 20.190.160.64
  • 20.190.160.132
  • 40.126.32.76
  • 40.126.32.133
whitelisted
arc.msn.com
  • 20.74.47.205
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
  • 2603:1030:7::106
whitelisted
15.164.165.52.in-addr.arpa
  • —
unknown
6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
7964
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
7964
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
7304
2019-01-16-Ursnif-retrieved-by-Hancitor-infected-host.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
616
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6592
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5936
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
684
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
684
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
664
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
664
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-01-16-Ursnif-retrieved-by-Hancitor-infected-host.exe