File name:

2025-06-03_a8d9ceb5322e940416d263ac908a3b3d_black-basta_mespinoza_ryuk

Full analysis: https://app.any.run/tasks/dd168129-b8db-4f23-a12e-7d0ab8197ec7
Verdict: Malicious activity
Analysis date: June 03, 2025, 00:53:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
m0yv
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

A8D9CEB5322E940416D263AC908A3B3D

SHA1:

90C212F6E434EE61384D15B099BBF5508D6456D8

SHA256:

76DAFE6580C964492A5938BEE1A5116780D1524EBC6D5FD2765A876E1D9CC9FE

SSDEEP:

49152:3FDHe3NWq0/5uaIs5F+tcLfDYyK1JQYanSyxuMg+vPYmla4q1MdFG1xQamKyqOFn:3FD+3NVan+cLLY3Jfa7MMg+vVlvqgFGS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV mutex has been found

      • 2025-06-03_a8d9ceb5322e940416d263ac908a3b3d_black-basta_mespinoza_ryuk.exe (PID: 5552)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Creates files in the program directory

      • 2025-06-03_a8d9ceb5322e940416d263ac908a3b3d_black-basta_mespinoza_ryuk.exe (PID: 5552)

    • The sample compiled with english language support

      • 2025-06-03_a8d9ceb5322e940416d263ac908a3b3d_black-basta_mespinoza_ryuk.exe (PID: 5552)

    • Creates files or folders in the user directory

      • 2025-06-03_a8d9ceb5322e940416d263ac908a3b3d_black-basta_mespinoza_ryuk.exe (PID: 5552)

    • Reads the computer name

      • 2025-06-03_a8d9ceb5322e940416d263ac908a3b3d_black-basta_mespinoza_ryuk.exe (PID: 5552)

    • Checks supported languages

      • 2025-06-03_a8d9ceb5322e940416d263ac908a3b3d_black-basta_mespinoza_ryuk.exe (PID: 5552)

    • Checks proxy server information

      • slui.exe (PID: 7036)

    • Reads the software policy settings

      • slui.exe (PID: 7036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2020:09:02 03:44:45+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14
CodeSize: 307712
InitializedDataSize: 192512
UninitializedDataSize: -
EntryPoint: 0x29960
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 9.2.1.920
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Intel Corporation
FileDescription: IntelCpHeciSvc Executable
InternalName: IntelCpHeciSvc
LegalCopyright: Copyright (C) 2011 Intel Corporation
LegalTrademarks: Intel Corporation
OriginalFileName: IntelCpHeciSvc.exe
ProductName: IntelCpHeciSvc Executable
ProductVersion: 9.2.01.0920
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #M0YV 2025-06-03_a8d9ceb5322e940416d263ac908a3b3d_black-basta_mespinoza_ryuk.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
5552"C:\Users\admin\Desktop\2025-06-03_a8d9ceb5322e940416d263ac908a3b3d_black-basta_mespinoza_ryuk.exe" C:\Users\admin\Desktop\2025-06-03_a8d9ceb5322e940416d263ac908a3b3d_black-basta_mespinoza_ryuk.exe
explorer.exe
User:
admin
Company:
Intel Corporation
Integrity Level:
MEDIUM
Description:
IntelCpHeciSvc Executable
Exit code:
2
Modules
Images
c:\users\admin\desktop\2025-06-03_a8d9ceb5322e940416d263ac908a3b3d_black-basta_mespinoza_ryuk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7036C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 371
Read events
3 371
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
55522025-06-03_a8d9ceb5322e940416d263ac908a3b3d_black-basta_mespinoza_ryuk.exeC:\Users\admin\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:3BBA150202C4928C215C374E8F0EB578
SHA256:380101F313722B0016F1C8CD5FF551EE5D0EEF98EA4912065D2C6BD56DA46A32
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
44
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
40.126.31.130:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
7768
RUXIMICS.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7768
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
40.126.31.2:443
https://login.live.com/RST2.srf
unknown
xml
11.0 Kb
whitelisted
—
—
GET
304
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
compressed
23.9 Kb
whitelisted
—
—
GET
200
13.95.31.18:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
2432
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2432
SIHClient.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
2432
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7768
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7768
RUXIMICS.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7768
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2432
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2432
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
  • 23.216.77.42
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.159.131
  • 20.190.159.23
  • 20.190.159.128
  • 20.190.159.129
  • 20.190.159.73
  • 20.190.159.64
  • 40.126.31.1
  • 40.126.31.131
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
self.events.data.microsoft.com
  • 104.208.16.89
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-03_a8d9ceb5322e940416d263ac908a3b3d_black-basta_mespinoza_ryuk