File name:

2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe

Full analysis: https://app.any.run/tasks/832cb7ad-8240-4d5e-bf64-0f7c9f2d952a
Verdict: Malicious activity
Threats:

Sality is a highly sophisticated malware known for infecting executable files and rapidly spreading across networks. It primarily creates a peer-to-peer botnet that is used for malicious activities such as spamming, data theft, and downloading additional malware. Sality has strong persistence mechanisms, including disabling security software, making it difficult to remove. Its ability to spread quickly and silently, along with its polymorphic nature, allows it to evade detection by traditional antivirus solutions.

Analysis date: August 01, 2025, 02:51:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sality
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

B9E28E8977865C8F6170D868BC77241C

SHA1:

CE5B8BF6FEA5DAB3DD23AEB7FB8DC840C1AC22EE

SHA256:

D1F87F433F4ABA389C53A65B8F1A9863D53EC8D8317D7A52D5B31F0AE180E558

SSDEEP:

98304:ffI3rsSUNLwsO7pJc5F4XkFKblYoXRhJVmAv8ZH5CMwwB8HL+Ir5Cp/LkZN6zB3q:nhHYKk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Disables Windows firewall

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Changes firewall settings

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • SALITY has been detected

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • SALITY mutex has been found

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • UAC/LUA settings modification

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Changes Security Center notification settings

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
      • ShellExperienceHost.exe (PID: 2124)
    • Reads Microsoft Outlook installation path

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Reads Internet Explorer settings

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Executable content was dropped or overwritten

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • There is functionality for taking screenshot (YARA)

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Process drops legitimate windows executable

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Drops a file with a rarely used extension (PIF)

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Creates file in the systems drive root

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
  • INFO

    • Checks supported languages

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
      • ShellExperienceHost.exe (PID: 2124)
    • Reads the computer name

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
      • ShellExperienceHost.exe (PID: 2124)
    • Checks proxy server information

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
      • slui.exe (PID: 5548)
    • Create files in a temporary directory

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • The sample compiled with english language support

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • UPX packer has been detected

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Reads the software policy settings

      • slui.exe (PID: 5548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:08:11 13:54:17+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 187392
InitializedDataSize: 75776
UninitializedDataSize: -
EntryPoint: 0x1c869
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SALITY 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe shellexperiencehost.exe no specs slui.exe 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2124"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
5300"C:\Users\admin\Desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe" C:\Users\admin\Desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5548C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6388"C:\Users\admin\Desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe" C:\Users\admin\Desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
6 174
Read events
6 100
Write events
73
Delete events
1

Modification events

(PID) Process:(2124) ShellExperienceHost.exeKey:\REGISTRY\A\{73e9894f-7b98-cb11-1676-80b2e768df94}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D00000037DD0D328F02DC01
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallDisableNotify
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallOverride
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:UpdatesDisableNotify
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:UacDisableNotify
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
Operation:writeName:EnableFirewall
Value:
0
Executable files
20
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe
MD5:
SHA256:
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Windows\system.inibinary
MD5:F399774BC1F42186AC76855B5D01D6B2
SHA256:15E660111499EE87B8E75A8049E3CD9563146606A3ECC3602860B53E682FABCD
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\autorun.infini
MD5:CA1D2080D06AF491437D495B0D61D5AC
SHA256:953D6ECBDEBD4D7821E60EAFF3A0E823985E5BDEA777BAE8D1F0430DDB2892DC
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\elspeu.pifexecutable
MD5:5B050BB60C2B77B7129D8F3EA1ED8091
SHA256:B2FD71445A91412D7E952A0C02116606FE70CB0E3C1AB809DF803A5D1B6B2404
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exeexecutable
MD5:1CBD1E9BBBD76187C950B3A76452EF39
SHA256:6EF5127702AD14AEA69B02F9F63AD275FE38C7D34A260188E4FCC7D4A38FB2FC
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exeexecutable
MD5:A0593C685617EB9B08BE3F8D858C5041
SHA256:F7EF6A112AFBB287C6089C22A44947FAA4B8BD25C5637401AD9B78F92704063E
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exeexecutable
MD5:66C8FEDA5C8CC5126DEC3BCC6FC74089
SHA256:CC5D88D8EB4F35CF4E3A372A3C1BF2D98D0981791096B2EDFEBB2D87C4128AA4
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeexecutable
MD5:1CBD1E9BBBD76187C950B3A76452EF39
SHA256:6EF5127702AD14AEA69B02F9F63AD275FE38C7D34A260188E4FCC7D4A38FB2FC
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\0018E1C0_Rar\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeexecutable
MD5:B9E28E8977865C8F6170D868BC77241C
SHA256:D1F87F433F4ABA389C53A65B8F1A9863D53EC8D8317D7A52D5B31F0AE180E558
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exeexecutable
MD5:219C90C5E07DEEAD56FA501947359A52
SHA256:55A39E3980E2BEF9D6488144305D088628FBBFF47E7107688A60B6AC8BC4EE0C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
19
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
SE
binary
825 b
whitelisted
1268
svchost.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
SE
binary
825 b
whitelisted
5288
RUXIMICS.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
SE
binary
825 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
QA
binary
814 b
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
QA
binary
814 b
whitelisted
5288
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
QA
binary
814 b
whitelisted
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5288
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
5944
MoUsoCoreWorker.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
1268
svchost.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5288
RUXIMICS.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5944
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
1268
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
self.events.data.microsoft.com
  • 104.208.16.91
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info