File name:

2019-09-16-initial-Ursnif-binary.exe

Full analysis: https://app.any.run/tasks/986e3133-c685-4f94-a572-608e33452793
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 07:32:05
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

0D0FA89EEBFE239090643BEA85F4B3B1

SHA1:

843B490217F0C4D564374645C08CDAAD5093AD15

SHA256:

DFC37FEB89896F9735E1DE97A61CC9750977D278E64E605AEB9C912C08AF5ECE

SSDEEP:

24576:C22PKyoGH0/dP/Nhs866QOfDmdmXwJ5q+cFJK8Clzga5ldZSGkI:C22PKyoGH0/dP/Nhs866QOfDmdPJ5q+R

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • iexplore.exe (PID: 8028)
      • iexplore.exe (PID: 7672)
      • iexplore.exe (PID: 1240)
      • iexplore.exe (PID: 8052)
      • iexplore.exe (PID: 3828)
      • iexplore.exe (PID: 7504)
      • iexplore.exe (PID: 3364)
      • iexplore.exe (PID: 7904)
      • iexplore.exe (PID: 7192)

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 8028)
      • iexplore.exe (PID: 7672)
      • iexplore.exe (PID: 1240)
      • iexplore.exe (PID: 3364)
      • iexplore.exe (PID: 3828)
      • iexplore.exe (PID: 7904)
      • iexplore.exe (PID: 7504)
      • iexplore.exe (PID: 8052)
      • iexplore.exe (PID: 7192)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 8028)
      • iexplore.exe (PID: 7672)
      • iexplore.exe (PID: 1240)
      • iexplore.exe (PID: 8052)
      • iexplore.exe (PID: 3828)
      • iexplore.exe (PID: 7504)
      • iexplore.exe (PID: 7904)
      • iexplore.exe (PID: 7192)
      • iexplore.exe (PID: 3364)

  • INFO

    • Checks supported languages

      • 2019-09-16-initial-Ursnif-binary.exe (PID: 7272)
      • ielowutil.exe (PID: 7932)

    • The sample compiled with english language support

      • 2019-09-16-initial-Ursnif-binary.exe (PID: 7272)

    • Reads the computer name

      • ielowutil.exe (PID: 7932)
      • 2019-09-16-initial-Ursnif-binary.exe (PID: 7272)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 7964)

    • Reads the software policy settings

      • slui.exe (PID: 7344)
      • slui.exe (PID: 7576)

    • Checks proxy server information

      • slui.exe (PID: 7576)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Win16/32 Executable Delphi generic (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:09:16 09:10:29+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 447488
InitializedDataSize: 154112
UninitializedDataSize: -
EntryPoint: 0xb190
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 9.7.43.46
ProductVersionNumber: 9.7.43.46
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Family letter
CompanyName: Middleball ePath Learning
FileDescription: StreamBar
InternalName: be.exe
FileVersion: 9.7.43.46
LegalCopyright: Copyright © 2007. All rights reserved.
OriginalFileName: be.exe
ProductVersion: 9.7.43.46
ProductName: StreamBar
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
173
Monitored processes
30
Malicious processes
14
Suspicious processes
4

Behavior graph

Click at the process to see the details
start 2019-09-16-initial-ursnif-binary.exe no specs sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
924"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1096"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1240"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2552"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3272"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5328 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3364"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7260 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3828"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6728 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4056"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:8068 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5328"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
45 970
Read events
45 694
Write events
230
Delete events
46

Modification events

(PID) Process:(7964) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(7964) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(7964) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(7964) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7964) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7964) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7964) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{5CB72EB4-094B-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(7964) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(7964) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(7964) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
Executable files
0
Suspicious files
46
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
8028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
2552iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{831ADE1A-094B-11F0-B4ED-18F7786F96EE}.datbinary
MD5:1338DA9729A58F976BAE9C6734676391
SHA256:BE253490053E7D9913C5A8B4DC669203D9BC6DF912F3B931F52B7DCD06E613D5
7496iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{763BEABE-094B-11F0-B4ED-18F7786F96EE}.datbinary
MD5:2BF3A40CFECB47B76719A681FC146533
SHA256:03BE45DC2F6786938EAC44489DAE6B7350215468831378DBB91E1EF9E8435444
7496iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF30D31A45C4072823.TMPbinary
MD5:EDF610E02D45541127FE02FEE3AB05AC
SHA256:F849BBD45E7D8E247814711BFA2785F73CB6ACE0C944A28DE537113CA0F2515D
2552iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFB335192BCF08DEA1.TMPbinary
MD5:4E353C435B517261A2B7DFC06CED14DA
SHA256:EEC662F1D603908C7C24FBCC3A52BD521E360F9C4F07802F77551755F8AC5A22
924iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF9A9B6DAE6D768DEA.TMPbinary
MD5:D8170F575CA875B70F045AABB7149E89
SHA256:6B81B25FA3BC29C15E3FBA457C02DEEF6883964355F874266A7F45CE3D658D53
7964iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{5CB72EB6-094B-11F0-B4ED-18F7786F96EE}.datbinary
MD5:5FF6E3DB6A5C2C9FC997875EB0F91262
SHA256:2752A78D0BFD7D55A29687539C45626545AC6A7C01CE2EF98217945B16A92031
2552iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFD9ADD874667596A5.TMPbinary
MD5:FEB6C3E02DF5DA7E60A8F41620BB09D2
SHA256:03F5F56DBEB08E2C290869C98CFFF2D5DC69E05F97B0412959E83011A428AA99
2552iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{831ADE1C-094B-11F0-B4ED-18F7786F96EE}.datbinary
MD5:9F27BD37EC16C1696A655F77678A93F3
SHA256:18B231EC7312759810198044DDBFEDDD33373E408FC62814A6D8CDB8B381B486
924iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFE4BBC84678C136C4.TMPbinary
MD5:21D14CC31AAAF3D915FE8DA1A4CD52AD
SHA256:0464C17497CE137B42CF72CDECCA82CC9250584BED1ACB8FE2300DA51EA6E69E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
100
DNS requests
24
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8028
iexplore.exe
GET
404
142.250.184.238:80
http://google.com/images/CzFlG78uMFISU/jdQ0SjvL/sMO6bZB4qDULvW18o51UhNs/y9JrPSwRpM/f0YWPsl_2BSv7DLR_/2F8wk_2BPAWU/JIvJWwnfycB/ypXvWa0BsylfX9/jQGloJAR19Pic06SGWidN/sPYt6gTtNu1co31Q/s1Z2zvLEnh/r.avi
unknown
—
—
whitelisted
7672
iexplore.exe
GET
404
49.13.77.253:80
http://b39delores88wsonya.com/images/9qkjVwbBA8ATXNI9p/6Kig9QW5awY5/C7Zy1B3isb7/VMVdDyP7jQA1WW/1rmuBySmfLNsYsY_2B3_2/BroiCm8Ge_2Fin9G/0y0Lm9Ch_2FuSHX/Kg2yhdeMFmdHjH0Zd5/mGan84BUs/cJfCWt_2BtddBlMuj0Oh/DhbO83b.avi
unknown
—
—
malicious
1240
iexplore.exe
GET
404
49.13.77.253:80
http://drossiefyadk.xyz/images/Tk0V31_2FUsXr8q_2BOq1/bY5I_2FKm42tI4Sc/MUhIHlraVp3O4l2/VN6pvo6PpRqXAFGhon/mRYKaYY_2/FmqOXvpSxxC92VMZ7SZT/_2Bk9QffARTNhLPlEii/4fASyQ2vMWJqRnc3_2FtjY/_2Ff_2B1rthVI/L05RGtDvqCG/E6.avi
unknown
—
—
malicious
3364
iexplore.exe
GET
404
142.250.184.238:80
http://google.com/images/ZoItPYqI/bMP4gxs3ocBEXPLXsMEOePB/YLwe1M3tmc/ziuxsyp7l7j_2BNk5/DdlTJ3TqZuim/KKE_2Fui8W2/ao03pMCY17kzdo/lRBsIdpEQPmvJs0tgc_2F/jAo_2BK8O3JWl8SI/9s3lx6PNV4vGa69/EJvSDNjvBEtUzrXZMD/h_2FBPflh/iBcuqXs.avi
unknown
—
—
whitelisted
—
—
GET
404
49.13.77.253:80
http://b39delores88wsonya.com/images/D86xe3FGwtlNDO/lWu6PMaSOhtjWvDDNAYXH/6tr4ykGgzPgbWJ0J/TId6CSe2PZ_2BUO/LUhvZgCsPWBV5ZVVLD/9ktpQKuyX/fBGX64mkRXeyFLMg_2B2/0UxxaR8amIWPeaLKaB6/mG8EZUG76BjnbuQFZSLFFX/dPl8qtNsYrK/FsIcJ60I/pa.avi
unknown
—
—
malicious
7904
iexplore.exe
GET
404
49.13.77.253:80
http://b98larry33.xyz/images/pbc3ROOfoX9/aOXIaxArZAillp/g36ODxqd1GwvZHxyg65QJ/NgaWWe0A3WJUUsLu/Yl3epuHoLxjwXhv/8FNB_2Bn1N_2FFe2d6/kE33hIrwK/o_2BNBUwIzIRvgwlxgxh/p_2BQ_2B5mMrYNqSA0U/vjg4f9WE5jkg/fC23_2F.avi
unknown
—
—
malicious
7504
iexplore.exe
GET
404
49.13.77.253:80
http://drossiefyadk.xyz/images/nl8gEW965JUtZksj_2FwP/7H4FNj68rIYRirhQ/Emhdj_2B0A_2BzJ/YWiCCkHuVWuooFbtZ7/0MI9Awg_2/FqmaYYOD6MXGvs5_2FlP/PT_2B_2FxXR5TBGY9kV/AQL1Z810fEz7rcc8y1GfDC/DCAbH1XOt0vb3/T73GBAcPS3/s.avi
unknown
—
—
malicious
7192
iexplore.exe
GET
404
216.58.206.46:80
http://google.com/images/KzBcoLfKSvHofI0K5nrP1l/5Pu5DN_2FYOFa/fzu_2Brw/ycLO3JrorpAxeiHK9Oe_2B8/LqWOGaRBA_/2Fbd5ZcXN3PbA_2FH/0nAlbIPjcvPh/Wc_2FRRqXvB/gWrsQFHE53St_2/FxaDEw9kjFDw5wu66vWbJ/5UzTjLcp/lI_2BHV.avi
unknown
—
—
whitelisted
8052
iexplore.exe
GET
404
49.13.77.253:80
http://b98larry33.xyz/images/wGhJRomkO/yqBsj5klZs_2Fj_2FyK2/D8dFPGV_2FbbdK_2BgT/EY6I8f_2FZA689Z4B_2FXH/MA8K5i9vNfMnH/qJHnzUPF/FQAkH7cRE_2BKp3YlPX6Mlg/AT3ZB1jaFM/j9Xm6de0_2Bf9eTc4/PqA2_2F7Xxml/xx_2B_2Fj7VBW/orExf7.avi
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
8028
iexplore.exe
142.250.184.238:80
google.com
GOOGLE
US
whitelisted
6544
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5960
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
920
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.238
  • 216.58.206.46
whitelisted
login.live.com
  • 20.190.160.67
  • 40.126.32.76
  • 20.190.160.2
  • 20.190.160.132
  • 20.190.160.22
  • 20.190.160.64
  • 20.190.160.128
  • 20.190.160.131
whitelisted
arc.msn.com
  • 20.103.156.88
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
  • 2a01:111:f100:a000::4134:4847
whitelisted
15.164.165.52.in-addr.arpa
  • —
unknown
7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
  • —
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted

Threats

PID
Process
Class
Message
8028
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
7672
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
1240
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
1240
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
8052
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
8052
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
3364
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
3364
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
3828
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
7504
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-09-16-initial-Ursnif-binary.exe