File name:

vegas.pro.15.0.0.x.[x64]-MPT.exe

Full analysis: https://app.any.run/tasks/e9125b12-9a18-4675-a762-58100c0e1031
Verdict: Malicious activity
Analysis date: April 25, 2025, 18:05:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
upx
discord
python
github
golang
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

1102BFADE45BB103286FCDB4C8582AB3

SHA1:

23CBAB1C8D3A1C3D4B6F2DF176270609E2C00136

SHA256:

88178AAF93D24FAF7EFBD1CBCDA102FF69B48181870588AB2E5F3223A5840A3B

SSDEEP:

6144:mK38ynuNyFaIyV8/S99R1/z2yOgSVvxAsl9QFHheDF0Ai5CLi:mK38ynvFaI2f993ayOgSVvWsl9wHc0t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • vegas.pro.15.0.0.x.[x64]-MPT.exe (PID: 7668)

    • Executable content was dropped or overwritten

      • vegas.pro.15.0.0.x.[x64]-MPT.exe (PID: 7668)
      • neptune.exe (PID: 660)

    • The process drops C-runtime libraries

      • neptune.exe (PID: 660)

    • Starts CMD.EXE for commands execution

      • neptune.exe (PID: 1184)

    • Uses WMIC.EXE to obtain Windows Installer data

      • neptune.exe (PID: 1184)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 1760)

    • Process drops legitimate windows executable

      • neptune.exe (PID: 660)

    • Process drops python dynamic module

      • neptune.exe (PID: 660)

    • Loads Python modules

      • neptune.exe (PID: 1184)

    • Reads security settings of Internet Explorer

      • neptune.exe (PID: 660)

  • INFO

    • Checks supported languages

      • vegas.pro.15.0.0.x.[x64]-MPT.exe (PID: 7668)
      • neptune.exe (PID: 660)
      • neptune.exe (PID: 1184)

    • The sample compiled with english language support

      • vegas.pro.15.0.0.x.[x64]-MPT.exe (PID: 7668)
      • neptune.exe (PID: 660)

    • Create files in a temporary directory

      • vegas.pro.15.0.0.x.[x64]-MPT.exe (PID: 7668)
      • neptune.exe (PID: 660)

    • Reads the computer name

      • vegas.pro.15.0.0.x.[x64]-MPT.exe (PID: 7668)
      • neptune.exe (PID: 1184)
      • neptune.exe (PID: 660)

    • UPX packer has been detected

      • vegas.pro.15.0.0.x.[x64]-MPT.exe (PID: 7668)

    • Reads the software policy settings

      • slui.exe (PID: 7800)
      • neptune.exe (PID: 1184)
      • slui.exe (PID: 7232)

    • Manual execution by a user

      • WinRAR.exe (PID: 5364)
      • neptune.exe (PID: 660)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5364)

    • Checks proxy server information

      • neptune.exe (PID: 1184)
      • slui.exe (PID: 7232)

    • Reads the machine GUID from the registry

      • neptune.exe (PID: 1184)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 1760)

    • Application based on Golang

      • neptune.exe (PID: 1184)

    • Detects GO elliptic curve encryption (YARA)

      • neptune.exe (PID: 1184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:12:21 20:59:46+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 512
InitializedDataSize: 221184
UninitializedDataSize: -
EntryPoint: 0x102b
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
16
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start vegas.pro.15.0.0.x.[x64]-mpt.exe sppextcomobj.exe no specs slui.exe slui.exe winrar.exe rundll32.exe no specs neptune.exe conhost.exe no specs neptune.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs vegas.pro.15.0.0.x.[x64]-mpt.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Users\admin\Desktop\RELEASE\neptune.exe" C:\Users\admin\Desktop\RELEASE\neptune.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225786
Modules
Images
c:\users\admin\desktop\release\neptune.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1184C:\Users\admin\Desktop\RELEASE\neptune.exeC:\Users\admin\AppData\Local\Temp\onefile_660_133900779982269658\neptune.exe
neptune.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225786
Modules
Images
c:\users\admin\appdata\local\temp\onefile_660_133900779982269658\neptune.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\onefile_660_133900779982269658\python313.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
1760wmic csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—neptune.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\ucrtbase.dll
2316C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—neptune.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
3888\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—neptune.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5364"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\RELEASE.7z" C:\Users\admin\Desktop\RELEASE\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6028C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—neptune.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6404C:\WINDOWS\system32\cmd.exe /c C:\Windows\System32\cmd.exe—neptune.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
7052C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
7184C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—neptune.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
6 684
Read events
6 679
Write events
5
Delete events
0

Modification events

(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
47
Suspicious files
599
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
7668vegas.pro.15.0.0.x.[x64]-MPT.exeC:\Users\admin\AppData\Local\Temp\dup2patcher.dllexecutable
MD5:9171881DBBE121EE55826166AECAE178
SHA256:690BD758B01B4F21723C915EF0846A3EFEE61161B8B8A2CF5137FECF099E887D
7668vegas.pro.15.0.0.x.[x64]-MPT.exeC:\Users\admin\AppData\Local\Temp\Berlin Sans FB.TTFbinary
MD5:FE2027C27B6A24505F548C6FD2E1076D
SHA256:0B6044C72E67AAAE9C2AE3C8B4BB06D066FDBC02779C68E3883984ACBBE24CB8
660neptune.exeC:\Users\admin\AppData\Local\Temp\onefile_660_133900779982269658\neptune.exeexecutable
MD5:E8F868B767C0A01148454113A421344A
SHA256:7711CA897390AAF08919061DC5A920D810822423F3D3B0A302AF4ED6E102E780
7668vegas.pro.15.0.0.x.[x64]-MPT.exeC:\Users\admin\AppData\Local\Temp\7CEB9B2A0E395BD64E74381485A106AF.dllexecutable
MD5:5AFB011D9DB047BB0400C5C5CA2E450B
SHA256:125FC74E03435B3E0EDE0FF523D625D9C1FBB299286E9E2DBD1442E506150DA6
5364WinRAR.exeC:\Users\admin\Desktop\RELEASE\neptune.exeexecutable
MD5:B65CAF2613DCAE2B9059973E7135D09C
SHA256:21A717965278424CC205417B2B23444E784BFB705B839254DD6C834B4479CF10
660neptune.exeC:\Users\admin\AppData\Local\Temp\onefile_660_133900779982269658\_decimal.pydexecutable
MD5:AD4324E5CC794D626FFCCDA544A5A833
SHA256:040F361F63204B55C17A100C260C7DDFADD00866CC055FBD641B83A6747547D5
660neptune.exeC:\Users\admin\AppData\Local\Temp\onefile_660_133900779982269658\_bz2.pydexecutable
MD5:C17DCB7FC227601471A641EC90E6237F
SHA256:55894B2B98D01F37B9A8CF4DAF926D0161FF23C2FB31C56F9DBBAC3A61932712
5364WinRAR.exeC:\Users\admin\Desktop\RELEASE\config.jsonbinary
MD5:976ED8151A0F5C43F6808365FFD9776F
SHA256:1AB748227A217166648411E814972BE88C2FC6C884ECD4EFF315810B891C4B70
660neptune.exeC:\Users\admin\AppData\Local\Temp\onefile_660_133900779982269658\_hashlib.pydexecutable
MD5:422E214CA76421E794B99F99A374B077
SHA256:78223AEF72777EFC93C739F5308A3FC5DE28B7D10E6975B8947552A62592772B
660neptune.exeC:\Users\admin\AppData\Local\Temp\onefile_660_133900779982269658\_brotli.pydexecutable
MD5:5ED46A7126DBDB70F3C60530E35BA035
SHA256:67DFA82DCAED04ED3F358D84B18D1375D59126161DE92E00164D36087B179D4D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
40
DNS requests
25
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4008
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4008
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
736
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
736
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
google.com
  • 216.58.206.78
whitelisted
login.live.com
  • 40.126.32.68
  • 20.190.160.67
  • 40.126.32.76
  • 20.190.160.64
  • 40.126.32.72
  • 20.190.160.20
  • 20.190.160.2
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
1184
neptune.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
1184
neptune.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
1184
neptune.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
1184
neptune.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
1184
neptune.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2196
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
1184
neptune.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
1184
neptune.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vegas.pro.15.0.0.x.[x64]-MPT.exe