File name:

2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos

Full analysis: https://app.any.run/tasks/59836334-0270-4acb-bba7-f3f2b752cdbf
Verdict: Malicious activity
Analysis date: March 31, 2025, 11:50:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
advancedinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

79F8D3B72BEFC7188DA3BFD4285803B9

SHA1:

EA8069975251FB76F15AD1AE298284EC8AE700A4

SHA256:

1B00F0C95FD19DE6AFEFF6C62DD6DFC851CE69253B4B2401731B1DD726D8C991

SSDEEP:

393216:Hr8S+7LTqKR31FAMEvDDrJqMUquA8lskWu10Kj1:YN1R3nJE39fUquA8ikWuuk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • ADVANCEDINSTALLER mutex has been found

      • 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe (PID: 7672)

    • Reads the Windows owner or organization settings

      • 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe (PID: 7672)
      • YTDSetup.tmp (PID: 7980)
      • msiexec.exe (PID: 7740)

    • Process drops legitimate windows executable

      • 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe (PID: 7672)
      • YTDSetup.tmp (PID: 7980)

    • Executable content was dropped or overwritten

      • 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe (PID: 7672)
      • YTDSetup.exe (PID: 7952)
      • YTDSetup.tmp (PID: 7980)

    • Reads security settings of Internet Explorer

      • 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe (PID: 7672)
      • YTDSetup.tmp (PID: 7980)
      • ytd.exe (PID: 1184)

    • There is functionality for taking screenshot (YARA)

      • 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe (PID: 7672)

    • Detects AdvancedInstaller (YARA)

      • 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe (PID: 7672)

    • Reads Internet Explorer settings

      • ytd.exe (PID: 1184)

    • Reads Microsoft Outlook installation path

      • ytd.exe (PID: 1184)

  • INFO

    • The sample compiled with english language support

      • 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe (PID: 7672)
      • YTDSetup.tmp (PID: 7980)
      • msiexec.exe (PID: 7740)

    • Reads Environment values

      • 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe (PID: 7672)
      • msiexec.exe (PID: 7836)
      • msiexec.exe (PID: 3884)
      • identity_helper.exe (PID: 4212)

    • Reads the computer name

      • 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe (PID: 7672)
      • msiexec.exe (PID: 7740)
      • msiexec.exe (PID: 7836)
      • YTDSetup.tmp (PID: 7980)
      • ytd.exe (PID: 1184)
      • msiexec.exe (PID: 3884)
      • identity_helper.exe (PID: 4212)
      • msiexec.exe (PID: 7252)

    • Checks supported languages

      • msiexec.exe (PID: 7740)
      • 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe (PID: 7672)
      • msiexec.exe (PID: 7836)
      • YTDSetup.exe (PID: 7952)
      • YTDSetup.tmp (PID: 7980)
      • ytd.exe (PID: 1184)
      • msiexec.exe (PID: 7252)
      • msiexec.exe (PID: 3884)
      • identity_helper.exe (PID: 4212)

    • Create files in a temporary directory

      • 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe (PID: 7672)
      • YTDSetup.exe (PID: 7952)
      • YTDSetup.tmp (PID: 7980)

    • Process checks computer location settings

      • 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe (PID: 7672)

    • Creates files in the program directory

      • YTDSetup.tmp (PID: 7980)

    • Creates a software uninstall entry

      • YTDSetup.tmp (PID: 7980)

    • Application launched itself

      • msedge.exe (PID: 7224)
      • msedge.exe (PID: 7316)

    • Manual execution by a user

      • msedge.exe (PID: 7316)

    • Reads the machine GUID from the registry

      • YTDSetup.tmp (PID: 7980)
      • ytd.exe (PID: 1184)

    • Reads the software policy settings

      • YTDSetup.tmp (PID: 7980)
      • ytd.exe (PID: 1184)
      • slui.exe (PID: 5740)

    • Disables trace logs

      • ytd.exe (PID: 1184)

    • Creates files or folders in the user directory

      • ytd.exe (PID: 1184)

    • Checks proxy server information

      • slui.exe (PID: 5740)
      • ytd.exe (PID: 1184)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (18)
.exe | Win32 Executable (generic) (2.9)
.exe | Generic Win/DOS Executable (1.3)
.exe | DOS Executable Generic (1.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:03 13:51:40+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.43
CodeSize: 2920960
InitializedDataSize: 1325568
UninitializedDataSize: -
EntryPoint: 0x2351b0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: GetintoWAY
FileDescription: YTD Video Downloader Ultimate 7.6.5.1 Installer
FileVersion: 0.0.0.0
InternalName: YTD Video Downloader Ultimate 7.6.5.1
LegalCopyright: Copyright (C) 2025 GetintoWAY
OriginalFileName: YTD Video Downloader Ultimate 7.6.5.1.exe
ProductName: YTD Video Downloader Ultimate 7.6.5.1
ProductVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
183
Monitored processes
54
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe msiexec.exe msiexec.exe no specs ytdsetup.exe ytdsetup.tmp msedge.exe no specs ytd.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1184"C:\Program Files (x86)\Azureus Software\YTD Video Downloader\ytd.exe"C:\Program Files (x86)\Azureus Software\YTD Video Downloader\ytd.exe
YTDSetup.tmp
User:
admin
Integrity Level:
HIGH
Description:
YTD
Version:
7.6.5.1
Modules
Images
c:\program files (x86)\azureus software\ytd video downloader\ytd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1272"C:\WINDOWS\system32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\YTD_Video_Downloader_Ultimate.msi AI_SETUPEXEPATH=C:\Users\admin\Desktop\2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe SETUPEXEDIR=C:\Users\admin\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1743420773 " AI_EUIMSI="" AI_MISSING_PREREQS="YTD Video Downloader Application"C:\Windows\SysWOW64\msiexec.exe—2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2088"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x310,0x314,0x318,0x308,0x320,0x7ffc89055fd8,0x7ffc89055fe4,0x7ffc89055ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2240"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4108 --field-trial-handle=2420,i,8722816933747562524,9420820038150297805,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2656"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=1668 --field-trial-handle=2420,i,8722816933747562524,9420820038150297805,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2852"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=6912 --field-trial-handle=2420,i,8722816933747562524,9420820038150297805,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3024"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6356 --field-trial-handle=2420,i,8722816933747562524,9420820038150297805,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3884C:\Windows\syswow64\MsiExec.exe -Embedding CF022D259076909644A98F066B739854C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3956"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6984 --field-trial-handle=2420,i,8722816933747562524,9420820038150297805,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4212"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6328 --field-trial-handle=2420,i,8722816933747562524,9420820038150297805,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
20 129
Read events
20 053
Write events
75
Delete events
1

Modification events

(PID) Process:(7224) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(7224) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(7224) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(7980) YTDSetup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Azureus Software\YTD
Operation:writeName:ISN
Value:
5F8D46741B1A409C98A9644C3A4E731E
(PID) Process:(7980) YTDSetup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Azureus Software\YTD
Operation:writeName:Language
Value:
1033
(PID) Process:(7980) YTDSetup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Azureus Software\YTD
Operation:writeName:kitType
Value:
PAD
(PID) Process:(7980) YTDSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\Azureus Software\YTD Video Downloader\ytd.exe,0
(PID) Process:(7980) YTDSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Operation:writeName:DisplayName
Value:
YTD Video Downloader 7.6.5.1
(PID) Process:(7980) YTDSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Operation:writeName:UninstallString
Value:
"C:\Program Files (x86)\Azureus Software\YTD Video Downloader\unins000.exe"
(PID) Process:(7980) YTDSetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Operation:writeName:Publisher
Value:
Azureus Software, Inc.
Executable files
43
Suspicious files
324
Text files
93
Unknown types
0

Dropped files

PID
Process
Filename
Type
76722025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exeC:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_7672\removicoimage
MD5:1FFFE5C3CC990D0C012A428A59B2AE46
SHA256:45791627AE8E67E6B616117CF21F04DA381722FAF08D07C0C25E0F28C9B8F82B
76722025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exeC:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_7672\custiconimage
MD5:BE6D2F48AA6634FB2101C273C798D4D9
SHA256:0E22BC2BF7184DFDB55223A11439304A453FB3574E3C9034A6497AF405C628EF
76722025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exeC:\Users\admin\AppData\Local\Temp\holder0.aiphbinary
MD5:F395345BD4CC564F63A56F4917ABB6BD
SHA256:B9D8616D1EA7925884DD259EFCB8CCCA6ECB88A954F6A3D52DC91C74633ECA4D
76722025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exeC:\Users\admin\AppData\Local\Temp\MSIFFC0.tmpexecutable
MD5:2330EBBE491C6026AF5E8853F3692798
SHA256:3ADA2257732FAE73114BB6A5E082CEF4BD72C3D6842924BE6F22728C7D7CACC4
76722025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exeC:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_7672\completiimage
MD5:C23AF89757665BC0386FD798A61B2112
SHA256:031ED0378F819926D7B5B2C6C9367A0FB1CBAE40E1A3959E2652FE30A47D52F2
76722025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exeC:\Users\admin\AppData\Local\Temp\MSIFE97.tmpexecutable
MD5:2330EBBE491C6026AF5E8853F3692798
SHA256:3ADA2257732FAE73114BB6A5E082CEF4BD72C3D6842924BE6F22728C7D7CACC4
76722025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exeC:\Users\admin\AppData\Local\Temp\MSI158.tmpexecutable
MD5:2330EBBE491C6026AF5E8853F3692798
SHA256:3ADA2257732FAE73114BB6A5E082CEF4BD72C3D6842924BE6F22728C7D7CACC4
76722025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exeC:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_7672\dialog.jpgimage
MD5:5F6253CFF5A8B031BFB3B161079D0D86
SHA256:36D9BAB35D1E4B50045BF902F5D42B6F865488C75F6E60FC00A6CD6F69034AB0
76722025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exeC:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_7672\insticonimage
MD5:EAC3781BA9FB0502D6F16253EB67B2B4
SHA256:F864E8640C98B65C6C1B9B66A850661E8397ED6E66B06F4424396275488AF1BE
76722025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos.exeC:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_7672\infoimage
MD5:8595D2A2D58310B448729E28649443D6
SHA256:27F13C4829994B214BB1A26EEF474DA67C521FD429536CB8421BA2F7C3E02B5F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
128
TCP/UDP connections
114
DNS requests
81
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
8080
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
8080
SIHClient.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
—
—
GET
401
13.107.6.158:443
https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox
unknown
—
—
—
—
—
OPTIONS
504
23.48.23.26:443
https://bzib.nelreports.net/api/report?cat=bingbusiness
unknown
—
—
—
8080
SIHClient.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
—
—
POST
200
40.126.32.140:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
400
40.126.32.140:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
2104
svchost.exe
23.216.77.36:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.216.77.36:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
20.190.159.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
20.190.159.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 20.198.162.78
whitelisted
crl.microsoft.com
  • 23.216.77.36
  • 23.216.77.28
  • 23.216.77.19
  • 23.216.77.25
  • 23.216.77.6
  • 2.16.241.19
  • 2.16.241.12
whitelisted
login.live.com
  • 20.190.159.129
  • 20.190.159.128
  • 40.126.31.69
  • 40.126.31.130
  • 40.126.31.128
  • 40.126.31.2
  • 40.126.31.1
  • 20.190.159.75
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.ytddownloader.com
  • 23.23.220.183
  • 98.83.247.165
  • 54.92.242.233
  • 52.207.28.40
  • 52.205.3.38
  • 54.209.112.23
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted

Threats

PID
Process
Class
Message
5280
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
5280
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
5280
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
5280
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
5280
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5280
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5280
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-03-31_79f8d3b72befc7188da3bfd4285803b9_black-basta_hijackloader_luca-stealer_remcos