File name:

2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe

Full analysis: https://app.any.run/tasks/832cb7ad-8240-4d5e-bf64-0f7c9f2d952a
Verdict: Malicious activity
Threats:

Sality is a highly sophisticated malware known for infecting executable files and rapidly spreading across networks. It primarily creates a peer-to-peer botnet that is used for malicious activities such as spamming, data theft, and downloading additional malware. Sality has strong persistence mechanisms, including disabling security software, making it difficult to remove. Its ability to spread quickly and silently, along with its polymorphic nature, allows it to evade detection by traditional antivirus solutions.

Analysis date: August 01, 2025, 02:51:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sality
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

B9E28E8977865C8F6170D868BC77241C

SHA1:

CE5B8BF6FEA5DAB3DD23AEB7FB8DC840C1AC22EE

SHA256:

D1F87F433F4ABA389C53A65B8F1A9863D53EC8D8317D7A52D5B31F0AE180E558

SSDEEP:

98304:ffI3rsSUNLwsO7pJc5F4XkFKblYoXRhJVmAv8ZH5CMwwB8HL+Ir5Cp/LkZN6zB3q:nhHYKk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes Security Center notification settings

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Disables Windows firewall

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Changes firewall settings

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • UAC/LUA settings modification

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • SALITY has been detected

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • SALITY mutex has been found

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Reads Internet Explorer settings

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • There is functionality for taking screenshot (YARA)

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Process drops legitimate windows executable

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Drops a file with a rarely used extension (PIF)

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Creates file in the systems drive root

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 2124)
      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Executable content was dropped or overwritten

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
  • INFO

    • Reads the computer name

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
      • ShellExperienceHost.exe (PID: 2124)
    • Checks supported languages

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
      • ShellExperienceHost.exe (PID: 2124)
    • Checks proxy server information

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
      • slui.exe (PID: 5548)
    • The sample compiled with english language support

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • UPX packer has been detected

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
    • Reads the software policy settings

      • slui.exe (PID: 5548)
    • Create files in a temporary directory

      • 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe (PID: 5300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:08:11 13:54:17+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 187392
InitializedDataSize: 75776
UninitializedDataSize: -
EntryPoint: 0x1c869
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SALITY 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe shellexperiencehost.exe no specs slui.exe 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2124"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
5300"C:\Users\admin\Desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe" C:\Users\admin\Desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5548C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6388"C:\Users\admin\Desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe" C:\Users\admin\Desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
6 174
Read events
6 100
Write events
73
Delete events
1

Modification events

(PID) Process:(2124) ShellExperienceHost.exeKey:\REGISTRY\A\{73e9894f-7b98-cb11-1676-80b2e768df94}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D00000037DD0D328F02DC01
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallDisableNotify
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallOverride
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:UpdatesDisableNotify
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:UacDisableNotify
Value:
1
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(5300) 2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
Operation:writeName:EnableFirewall
Value:
0
Executable files
20
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exe
MD5:
SHA256:
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\0018E23D_Rar\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeexecutable
MD5:B9E28E8977865C8F6170D868BC77241C
SHA256:D1F87F433F4ABA389C53A65B8F1A9863D53EC8D8317D7A52D5B31F0AE180E558
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeexecutable
MD5:893D706A82C1F3FAFA66935382B9DB0F
SHA256:0AB40DBC4B9668EDFE9DE3184F350A48B1A137EBD69BF49A47ECB3D9CEF40904
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\autorun.infini
MD5:CA1D2080D06AF491437D495B0D61D5AC
SHA256:953D6ECBDEBD4D7821E60EAFF3A0E823985E5BDEA777BAE8D1F0430DDB2892DC
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Windows\system.inibinary
MD5:F399774BC1F42186AC76855B5D01D6B2
SHA256:15E660111499EE87B8E75A8049E3CD9563146606A3ECC3602860B53E682FABCD
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\ewyyi.exeexecutable
MD5:B360FA63134A63F9ACFE046D2DFE10D9
SHA256:03E0C6C4CA8A24F961477887763397045E67862E059F7494014AEFC21891D40E
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exeexecutable
MD5:3374775779CDECAC5C87A8E89B8FE7B8
SHA256:C07315A0B9834CBF2D36808BCDF3BF8E3F3C6343E767617BDCF31D3ECD9D432D
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\winfcircy.exeexecutable
MD5:B360FA63134A63F9ACFE046D2DFE10D9
SHA256:03E0C6C4CA8A24F961477887763397045E67862E059F7494014AEFC21891D40E
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\0018E1C0_Rar\2025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeexecutable
MD5:B9E28E8977865C8F6170D868BC77241C
SHA256:D1F87F433F4ABA389C53A65B8F1A9863D53EC8D8317D7A52D5B31F0AE180E558
53002025-08-01_b9e28e8977865c8f6170d868bc77241c_black-basta_elex_luca-stealer.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exeexecutable
MD5:977E405C109268909FD24A94CC23D4F0
SHA256:CD24C61FE7DC3896C6C928C92A2ADC58FAB0A3FF61EF7DDCAC1BA794182AB12F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
19
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1268
svchost.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5288
RUXIMICS.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5288
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5288
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
5944
MoUsoCoreWorker.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
1268
svchost.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5288
RUXIMICS.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5944
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
1268
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
self.events.data.microsoft.com
  • 104.208.16.91
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info