File name:

2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza

Full analysis: https://app.any.run/tasks/22e5ed5b-7789-4bd9-9893-b70ae461f7af
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: April 29, 2025, 13:00:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sality
sainbox
rat
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

E829E0D8112816C45EC41D3195084719

SHA1:

BEF34718B90AE23B5577607009F3E08F1317EA7C

SHA256:

EB185A43F1E98C9B0F987BC8909A755F6C4C2B65890F0F8C63AEA4F5EAD56E70

SSDEEP:

98304:HdTSE5Pwzyv17++9udaJQLruSpjmtbNyVX/Bpm7Ece/Unba+O+CB3jD9M3z:bz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • SALITY mutex has been found

      • 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe (PID: 7740)
    • SALITY has been detected

      • 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe (PID: 7740)
    • SAINBOX has been detected

      • 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe (PID: 7740)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe (PID: 7740)
    • There is functionality for taking screenshot (YARA)

      • 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe (PID: 7740)
    • Process drops legitimate windows executable

      • 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe (PID: 7740)
    • Creates file in the systems drive root

      • 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe (PID: 7740)
  • INFO

    • The sample compiled with chinese language support

      • 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe (PID: 7740)
    • Checks supported languages

      • 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe (PID: 7740)
    • Reads the computer name

      • 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe (PID: 7740)
    • Create files in a temporary directory

      • 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe (PID: 7740)
    • UPX packer has been detected

      • 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe (PID: 7740)
    • The sample compiled with english language support

      • 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe (PID: 7740)
    • Checks proxy server information

      • slui.exe (PID: 7504)
    • Reads the software policy settings

      • slui.exe (PID: 7504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (16.3)
.exe | Win64 Executable (generic) (14.5)
.dll | Win32 Dynamic Link Library (generic) (3.4)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:07:30 11:07:13+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 1637376
InitializedDataSize: 2605056
UninitializedDataSize: -
EntryPoint: 0x156d07
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.3.0
ProductVersionNumber: 1.0.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileDescription: MobileScreen
FileVersion: 1.0.3.0
InternalName: MobileScreen.exe
OriginalFileName: MobileScreen.exe
ProductVersion: 1.0.1.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
126
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SALITY 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7504C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7740"C:\Users\admin\Desktop\2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe" C:\Users\admin\Desktop\2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
MobileScreen
Version:
1.0.3.0
Modules
Images
c:\users\admin\desktop\2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
3 599
Read events
3 547
Write events
52
Delete events
0

Modification events

(PID) Process:(7740) 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(7740) 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a1_0
Value:
864422203
(PID) Process:(7740) 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a2_0
Value:
6989
(PID) Process:(7740) 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a3_0
Value:
17001001
(PID) Process:(7740) 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a4_0
Value:
0
(PID) Process:(7740) 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a1_1
Value:
86872797
(PID) Process:(7740) 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a2_1
Value:
(PID) Process:(7740) 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a3_1
Value:
(PID) Process:(7740) 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a4_1
Value:
(PID) Process:(7740) 2025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a1_2
Value:
Executable files
3
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
77402025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeC:\Users\admin\Desktop\log\L2025-04-29.logtext
MD5:D031253F2E3566E50FD7E6662A05550A
SHA256:436F79658E795BEBD357C2A016EC28517EC7AD6812E7721A6C9142494F2EBF85
77402025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeC:\Users\admin\AppData\Local\Temp\winvshmc.exeexecutable
MD5:B360FA63134A63F9ACFE046D2DFE10D9
SHA256:03E0C6C4CA8A24F961477887763397045E67862E059F7494014AEFC21891D40E
77402025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exeexecutable
MD5:E6542064A3D098E18B31D93E76EA90A6
SHA256:7B25E783E92A7664C170DF3AC7E4C1A817664E7D28F9CBF8A9C049053C149BA8
77402025-04-29_e829e0d8112816c45ec41d3195084719_black-basta_darkgate_elex_luca-stealer_mespinoza.exeC:\Users\admin\AppData\Local\Temp\acydel.exeexecutable
MD5:B360FA63134A63F9ACFE046D2DFE10D9
SHA256:03E0C6C4CA8A24F961477887763397045E67862E059F7494014AEFC21891D40E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
51
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
2104
svchost.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
304
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
7284
SIHClient.exe
GET
200
23.48.23.191:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
whitelisted
7284
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
whitelisted
7284
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
whitelisted
GET
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
POST
400
40.126.32.140:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
POST
400
20.190.160.132:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
POST
200
20.190.160.132:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7284
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.174
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.155
  • 23.48.23.158
  • 23.48.23.175
  • 23.48.23.162
  • 23.48.23.169
  • 23.48.23.168
  • 23.48.23.150
  • 23.48.23.151
  • 23.48.23.191
  • 23.48.23.177
  • 23.48.23.178
  • 23.48.23.193
  • 23.48.23.185
  • 23.48.23.139
  • 23.48.23.181
  • 23.48.23.183
  • 23.48.23.176
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.159.128
  • 20.190.159.4
  • 20.190.159.68
  • 20.190.159.73
  • 20.190.159.0
  • 20.190.159.64
  • 20.190.159.129
  • 40.126.31.73
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted

Threats

No threats detected
No debug info