File name:

2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom

Full analysis: https://app.any.run/tasks/4c5cc758-19be-4900-ad36-1390fa98b0b5
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 12, 2025, 02:31:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 6 sections
MD5:

F16B85DE0D4CC0807DFECD16069E742B

SHA1:

633262762080E7CB7ACBC5810A5C83EDB7911B7E

SHA256:

5E88F40A24F42507F85CE180214DB231354E8603FB0133F7D612184A5B41B227

SSDEEP:

24576:e7QrV0Vxl7AzS6fFiYjOA8rLuSneBtwB:e7m0Vxl7AzS6fFiix8/uoefw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RANSOMWARE has been detected

      • 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe (PID: 5800)

    • Renames files like ransomware

      • 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe (PID: 5800)

    • Modifies files in the Chrome extension folder

      • 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe (PID: 5800)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe (PID: 5800)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe (PID: 5800)

  • INFO

    • Create files in a temporary directory

      • 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe (PID: 5800)

    • Checks supported languages

      • 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe (PID: 5800)

    • Reads the computer name

      • 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe (PID: 5800)

    • Manual execution by a user

      • OpenWith.exe (PID: 4272)
      • rundll32.exe (PID: 1132)
      • OpenWith.exe (PID: 1912)
      • notepad.exe (PID: 5988)
      • OpenWith.exe (PID: 6652)
      • rundll32.exe (PID: 6768)
      • OpenWith.exe (PID: 5608)
      • rundll32.exe (PID: 4068)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 4272)
      • OpenWith.exe (PID: 1912)
      • OpenWith.exe (PID: 6652)
      • OpenWith.exe (PID: 5608)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 5988)

    • Creates files or folders in the user directory

      • 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe (PID: 5800)

    • Reads the software policy settings

      • slui.exe (PID: 4756)

    • Checks proxy server information

      • slui.exe (PID: 4756)

    • Creates files in the program directory

      • 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe (PID: 5800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:09 12:50:31+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 323072
InitializedDataSize: 2292224
UninitializedDataSize: -
EntryPoint: 0x2c5b4
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
12
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe conhost.exe no specs openwith.exe no specs rundll32.exe no specs openwith.exe no specs notepad.exe no specs openwith.exe no specs rundll32.exe no specs openwith.exe no specs rundll32.exe no specs slui.exe 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1132"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\throughoutmale.pngC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1912"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\desktop.ini.desolatedC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4040"C:\Users\admin\Desktop\2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe" C:\Users\admin\Desktop\2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe
c:\windows\system32\ntdll.dll
4068"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\rightsattention.jpgC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
4272"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\desector.jpg.desolatedC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4756C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5344\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5608"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\rightsattention.jpg.desolatedC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5800"C:\Users\admin\Desktop\2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe" C:\Users\admin\Desktop\2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5988"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Downloads\desktop.iniC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
5 957
Read events
5 951
Write events
6
Delete events
0

Modification events

(PID) Process:(5800) 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
18
(PID) Process:(4272) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.desolated\OpenWithProgids
Operation:writeName:DesolatedFile
Value:
(PID) Process:(1912) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.desolated\OpenWithProgids
Operation:writeName:DesolatedFile
Value:
(PID) Process:(6652) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.desolated\OpenWithProgids
Operation:writeName:DesolatedFile
Value:
(PID) Process:(5608) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.desolated\OpenWithProgids
Operation:writeName:DesolatedFile
Value:
(PID) Process:(5800) 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization
Operation:writeName:LockScreenImage
Value:
C:\Users\admin\AppData\Local\Temp\desolated_wallpaper.jpg
Executable files
16
Suspicious files
3 862
Text files
761
Unknown types
0

Dropped files

PID
Process
Filename
Type
58002025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exeC:\Recovery\ReAgentOld.xmlbinary
MD5:6DD4559562030F52FE83A2B69DA0A039
SHA256:04C1E4810357438E6535A24B28382F028D2FA8BB979F59EB5DC7E09FE438C5C3
58002025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exeC:\Recovery\OEM\ResetConfig.xmlbinary
MD5:93D23F0578B7588257B46755E51F06F4
SHA256:52F67ED3C556171F328EF26FBF014082199392452B8B750648C65542FBC346E0
58002025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exeC:\$WinREAgent\Backup\ReAgent.xmlbinary
MD5:1680F3958DBD56DAA533B78F29319248
SHA256:7DFD9DD6A48839F801A6A30AA857CB8958A3494BEEE63782784AB66D0819F411
58002025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exeC:\$WinREAgent\Backup\ReAgent.xml.desolatedbinary
MD5:1680F3958DBD56DAA533B78F29319248
SHA256:7DFD9DD6A48839F801A6A30AA857CB8958A3494BEEE63782784AB66D0819F411
58002025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exeC:\Users\desktop.inibinary
MD5:37CD679A8984108E81682532DE1CA349
SHA256:695BC87311D94293BA430EDB31F91F70665D6DD95EB64EF18E15C06AB7764063
58002025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exeC:\Recovery\ReAgentOld.xml.desolatedbinary
MD5:6DD4559562030F52FE83A2B69DA0A039
SHA256:04C1E4810357438E6535A24B28382F028D2FA8BB979F59EB5DC7E09FE438C5C3
58002025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exeC:\$WinREAgent\Backup\location.txtbinary
MD5:BB7084137C011E1CE3F33F88DF4FE58C
SHA256:6A13016F6C320B5A745BDB2D8F6D37BA86870E2F5604257BFA6C9944DA5AD215
58002025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exeC:\Users\desktop.ini.desolatedbinary
MD5:37CD679A8984108E81682532DE1CA349
SHA256:695BC87311D94293BA430EDB31F91F70665D6DD95EB64EF18E15C06AB7764063
58002025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exeC:\$WinREAgent\Backup\location.txt.desolatedbinary
MD5:BB7084137C011E1CE3F33F88DF4FE58C
SHA256:6A13016F6C320B5A745BDB2D8F6D37BA86870E2F5604257BFA6C9944DA5AD215
58002025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom.exeC:\$WinREAgent\RollbackInfo.inibinary
MD5:B02760D94086008C2140D00110CB18FA
SHA256:61BFC2897D4223055F8991C3089DF5B6D12DBF4E42CB017FE298D2F435AB859C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
20
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4108
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4756
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 216.58.212.174
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom