File name:

2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe

Full analysis: https://app.any.run/tasks/832cb7ad-8240-4d5e-bf64-0f7c9f2d952a
Verdict: Malicious activity
Threats:

Sality is a highly sophisticated malware known for infecting executable files and rapidly spreading across networks. It primarily creates a peer-to-peer botnet that is used for malicious activities such as spamming, data theft, and downloading additional malware. Sality has strong persistence mechanisms, including disabling security software, making it difficult to remove. Its ability to spread quickly and silently, along with its polymorphic nature, allows it to evade detection by traditional antivirus solutions.

Analysis date: August 01, 2025, 02:51:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sality
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

B9E28E8977865C8F6170D868BC77241C

SHA1:

CE5B8BF6FEA5DAB3DD23AEB7FB8DC840C1AC22EE

SHA256:

D1F87F433F4ABA389C53A65B8F1A9863D53EC8D8317D7A52D5B31F0AE180E558

SSDEEP:

98304:ffI3rsSUNLwsO7pJc5F4XkFKblYoXRhJVmAv8ZH5CMwwB8HL+Ir5Cp/LkZN6zB3q:nhHYKk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • UAC/LUA settings modification

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Changes Security Center notification settings

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • SALITY mutex has been found

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Changes firewall settings

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • SALITY has been detected

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Disables Windows firewall

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Reads security settings of Internet Explorer

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
      • ShellExperienceHost.exe (PID: 2124)
    • Reads Internet Explorer settings

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Reads Microsoft Outlook installation path

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • There is functionality for taking screenshot (YARA)

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Process drops legitimate windows executable

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Drops a file with a rarely used extension (PIF)

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Creates file in the systems drive root

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
  • INFO

    • Reads the computer name

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
      • ShellExperienceHost.exe (PID: 2124)
    • Create files in a temporary directory

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Checks supported languages

      • ShellExperienceHost.exe (PID: 2124)
      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • The sample compiled with english language support

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Checks proxy server information

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
      • slui.exe (PID: 5548)
    • Reads the software policy settings

      • slui.exe (PID: 5548)
    • UPX packer has been detected

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:08:11 13:54:17+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 187392
InitializedDataSize: 75776
UninitializedDataSize: -
EntryPoint: 0x1c869
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SALITY 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe shellexperiencehost.exe no specs slui.exe 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2124"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
5300"C:\Users\admin\Desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe" C:\Users\admin\Desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5548C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6388"C:\Users\admin\Desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe" C:\Users\admin\Desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
6 174
Read events
6 100
Write events
73
Delete events
1

Modification events

(PID) Process:(2124) ShellExperienceHost.exeKey:\REGISTRY\A\{73e9894f-7b98-cb11-1676-80b2e768df94}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D00000037DD0D328F02DC01
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallDisableNotify
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallOverride
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:UpdatesDisableNotify
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:UacDisableNotify
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
Operation:writeName:EnableFirewall
Value:
0
Executable files
20
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe
MD5:
SHA256:
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\0018E23D_Rar\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeexecutable
MD5:B9E28E8977865C8F6170D868BC77241C
SHA256:D1F87F433F4ABA389C53A65B8F1A9863D53EC8D8317D7A52D5B31F0AE180E558
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\ewyyi.exeexecutable
MD5:B360FA63134A63F9ACFE046D2DFE10D9
SHA256:03E0C6C4CA8A24F961477887763397045E67862E059F7494014AEFC21891D40E
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\0018E1C0_Rar\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeexecutable
MD5:B9E28E8977865C8F6170D868BC77241C
SHA256:D1F87F433F4ABA389C53A65B8F1A9863D53EC8D8317D7A52D5B31F0AE180E558
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exeexecutable
MD5:219C90C5E07DEEAD56FA501947359A52
SHA256:55A39E3980E2BEF9D6488144305D088628FBBFF47E7107688A60B6AC8BC4EE0C
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exeexecutable
MD5:977E405C109268909FD24A94CC23D4F0
SHA256:CD24C61FE7DC3896C6C928C92A2ADC58FAB0A3FF61EF7DDCAC1BA794182AB12F
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exeexecutable
MD5:3374775779CDECAC5C87A8E89B8FE7B8
SHA256:C07315A0B9834CBF2D36808BCDF3BF8E3F3C6343E767617BDCF31D3ECD9D432D
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exeexecutable
MD5:8E28D0B408C981B517CF90D6DCE6BD29
SHA256:FE03F76CD7ED1782E58FA77C12576042F56FC494C94163E9C74E33B11D4EAA14
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exeexecutable
MD5:1CBD1E9BBBD76187C950B3A76452EF39
SHA256:6EF5127702AD14AEA69B02F9F63AD275FE38C7D34A260188E4FCC7D4A38FB2FC
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeexecutable
MD5:893D706A82C1F3FAFA66935382B9DB0F
SHA256:0AB40DBC4B9668EDFE9DE3184F350A48B1A137EBD69BF49A47ECB3D9CEF40904
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
19
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1268
svchost.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5288
RUXIMICS.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5288
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5288
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
5944
MoUsoCoreWorker.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
1268
svchost.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5288
RUXIMICS.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5944
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
1268
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
self.events.data.microsoft.com
  • 104.208.16.91
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info