File name:

2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader

Full analysis: https://app.any.run/tasks/0a2a1227-7e02-4306-bd5a-f080df6ce9ae
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: May 17, 2025, 02:52:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sality
sainbox
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

81B9EF17FFB09D495E927D12B462B807

SHA1:

6056B9376C242EA2ADBC5F0DB61F02EF30CB20B8

SHA256:

7EAA5D742E2B770A158887568CD41D7466F0CF224B3C12FD7D5D35B313559A07

SSDEEP:

98304:G+nWPGyS3om3PsQ8GUPNafRRWA5wwC4wtS86hjc:ajt5V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • SALITY has been detected

      • 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exe (PID: 7440)
    • SALITY mutex has been found

      • 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exe (PID: 7440)
    • SAINBOX has been detected

      • 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exe (PID: 7440)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exe (PID: 7440)
    • Searches for installed software

      • 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exe (PID: 7440)
  • INFO

    • The sample compiled with chinese language support

      • 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exe (PID: 7440)
    • Reads the computer name

      • 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exe (PID: 7440)
    • Create files in a temporary directory

      • 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exe (PID: 7440)
    • Checks supported languages

      • 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exe (PID: 7440)
    • Checks proxy server information

      • slui.exe (PID: 7744)
    • Reads the software policy settings

      • slui.exe (PID: 7744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:26 09:25:54+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 1627136
InitializedDataSize: 832000
UninitializedDataSize: -
EntryPoint: 0x15fa76
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 5.9.6.40726
ProductVersionNumber: 5.9.6.40726
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: 沧州句号网络科技有限公司
FileDescription: 贝壳PDF阅读器-WIN助手
InternalName: 贝壳PDF阅读器-WIN助手
LegalCopyright: Copyright (C) 2024 沧州句号网络科技有限公司
OriginalFileName: BKMo.exe
ProductName: 贝壳PDF阅读器-WIN助手
ProductVersion: 5,9,6,40726
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
122
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SALITY 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7440"C:\Users\admin\Desktop\2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exe" C:\Users\admin\Desktop\2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exe
explorer.exe
User:
admin
Company:
沧州句号网络科技有限公司
Integrity Level:
MEDIUM
Description:
贝壳PDF阅读器-WIN助手
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7744C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 672
Read events
3 636
Write events
36
Delete events
0

Modification events

(PID) Process:(7440) 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(7440) 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a1_0
Value:
332287070
(PID) Process:(7440) 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a2_0
Value:
1473
(PID) Process:(7440) 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a3_0
Value:
17001001
(PID) Process:(7440) 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a4_0
Value:
0
(PID) Process:(7440) 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a1_1
Value:
435501916
(PID) Process:(7440) 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a2_1
Value:
(PID) Process:(7440) 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a3_1
Value:
(PID) Process:(7440) 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a4_1
Value:
(PID) Process:(7440) 2025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a1_2
Value:
153730588
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
74402025-05-17_81b9ef17ffb09d495e927d12b462b807_amadey_black-basta_coinminer_darkgate_elex_gcleaner_luca-stealer_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\winnfbfh.exeexecutable
MD5:B360FA63134A63F9ACFE046D2DFE10D9
SHA256:03E0C6C4CA8A24F961477887763397045E67862E059F7494014AEFC21891D40E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
19
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4
System
192.168.100.255:138
whitelisted
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
780
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7744
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.46
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info