Malware analysis VCS antivirus.exe Malicious activity

Add for printing

File name:	VCS antivirus.exe
Full analysis:	https://app.any.run/tasks/ceb8f18f-ce0b-4b14-9569-c17e0c12fdd7
Verdict:	Malicious activity
Analysis date:	May 19, 2025, 04:11:01
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	github telegram python arch-exec arch-doc pyinstaller ims-api generic
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:	3EEEFAA309C8B93EFE5E99ECF85EA227
SHA1:	E0F6A44AB200A0A0A7959CCA664618B6B8E02797
SHA256:	EA5D1E2D0DDCC874CBFE969D7BF49E58F980BCE01501F4E8A53107A0DACFF736
SSDEEP:	98304:Nv7i+tfi42kGJsXukTemIMpYftHfktEzafhOsE+XZ0FdD1yTK4qVcYGCh1GJIbj1:Nrn2QJpZf7AktijSem866s55cm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Uses AES cipher (POWERSHELL)
  - powershell.exe (PID: 5064)
SUSPICIOUS
- Process drops legitimate windows executable
  - VCS antivirus.exe (PID: 4688)
- Process drops python dynamic module
  - VCS antivirus.exe (PID: 4688)
- Executable content was dropped or overwritten
  - VCS antivirus.exe (PID: 4688)
  - VCS antivirus.exe (PID: 7020)
- Application launched itself
  - VCS antivirus.exe (PID: 4688)
- The process drops C-runtime libraries
  - VCS antivirus.exe (PID: 4688)
- Loads Python modules
  - VCS antivirus.exe (PID: 7020)
- Get information on the list of running processes
  - VCS antivirus.exe (PID: 7020)
- The process executes Powershell scripts
  - VCS antivirus.exe (PID: 7020)
- Starts POWERSHELL.EXE for commands execution
  - VCS antivirus.exe (PID: 7020)
- Uses base64 encoding (POWERSHELL)
  - powershell.exe (PID: 5064)
- Creates file in the systems drive root
  - powershell.exe (PID: 5064)
- Process communicates with Telegram (possibly using it as an attacker's C2 server)
  - VCS antivirus.exe (PID: 7020)
- Gets content of a file (POWERSHELL)
  - powershell.exe (PID: 5064)
- Possible usage of Discord/Telegram API has been detected (YARA)
  - VCS antivirus.exe (PID: 7020)
- There is functionality for taking screenshot (YARA)
  - VCS antivirus.exe (PID: 4688)
  - VCS antivirus.exe (PID: 7020)
INFO
- The sample compiled with english language support
  - VCS antivirus.exe (PID: 4688)
  - VCS antivirus.exe (PID: 7020)
- Reads the computer name
  - VCS antivirus.exe (PID: 4688)
  - VCS antivirus.exe (PID: 7020)
  - sdelete.exe (PID: 2980)
- Checks supported languages
  - VCS antivirus.exe (PID: 4688)
  - VCS antivirus.exe (PID: 7020)
  - sdelete.exe (PID: 2980)
- Create files in a temporary directory
  - VCS antivirus.exe (PID: 4688)
  - VCS antivirus.exe (PID: 7020)
- Checks whether the specified file exists (POWERSHELL)
  - powershell.exe (PID: 5064)
- Script raised an exception (POWERSHELL)
  - powershell.exe (PID: 5064)
- Uses string replace method (POWERSHELL)
  - powershell.exe (PID: 5064)
- Gets or sets the time when the file was last written to (POWERSHELL)
  - powershell.exe (PID: 5064)
- Checks proxy server information
  - VCS antivirus.exe (PID: 7020)
- PyInstaller has been detected (YARA)
  - VCS antivirus.exe (PID: 4688)
  - VCS antivirus.exe (PID: 7020)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

ims-api

(PID) Process(7020) VCS antivirus.exe

Telegram-Tokens (1)7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0

Telegram-Info-Links

7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0

Get info about bothttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/getMe

Get incoming updateshttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/getUpdates

Get webhookhttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/getWebhookInfo

Delete webhookhttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/deleteWebhook

Drop incoming updateshttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/deleteWebhook?drop_pending_updates=true

Telegram-Tokens (1)7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0

Telegram-Info-Links

7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0

Get info about bothttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/getMe

Get incoming updateshttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/getUpdates

Get webhookhttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/getWebhookInfo

Delete webhookhttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/deleteWebhook

Drop incoming updateshttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/deleteWebhook?drop_pending_updates=true

Telegram-Requests

Token7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0

End-PointsendMessage

Args

Telegram-Responses

oktrue

result

message_id573

from

id7457737016

is_bottrue

first_nametmqsuperbot_bot

usernametmqsuperbot_bot

chat

id1617506446

first_namepy

usernamepy0bf3c4t0r

typeprivate

date1747627877

textKey: Q1uFCmEC85EC4IAnaT1/mpVFbMMli4xyqfL/0HCQevs= IV: JbaGgeB5IYdrJYNldeXP9w==

has_protected_contenttrue

Telegram-Responses

oktrue

result

message_id573

from

id7457737016

is_bottrue

first_nametmqsuperbot_bot

usernametmqsuperbot_bot

chat

id1617506446

first_namepy

usernamepy0bf3c4t0r

typeprivate

date1747627877

textKey: Q1uFCmEC85EC4IAnaT1/mpVFbMMli4xyqfL/0HCQevs= IV: JbaGgeB5IYdrJYNldeXP9w==

has_protected_contenttrue

No Malware configuration.

Add for printing

TRiD

.exe	\|	InstallShield setup (57.6)
.exe	\|	Win64 Executable (generic) (36.9)
.exe	\|	Generic Win/DOS Executable (2.6)
.exe	\|	DOS Executable Generic (2.6)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	2024:09:07 05:18:22+00:00
ImageFileCharacteristics:	Executable, Large address aware
PEType:	PE32+
LinkerVersion:	14.37
CodeSize:	171520
InitializedDataSize:	162304
UninitializedDataSize:	-
EntryPoint:	0xc2f0
OSVersion:	5.2
ImageVersion:	-
SubsystemVersion:	5.2
Subsystem:	Windows GUI

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

135

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1180

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

1272

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll

2980

C:\Users\admin\AppData\Local\Temp\_MEI46882\sdelete.exe C:\Users\admin\AppData\Local\Temp\_MEI46882\ps.ps1

C:\Users\admin\AppData\Local\Temp\_MEI46882\sdelete.exe

—

VCS antivirus.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\appdata\local\temp\_mei46882\sdelete.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

3096

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

sdelete.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

4688

"C:\Users\admin\AppData\Local\Temp\VCS antivirus.exe"

C:\Users\admin\AppData\Local\Temp\VCS antivirus.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\appdata\local\temp\vcs antivirus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

5064

powershell.exe -File C:\Users\admin\AppData\Local\Temp\_MEI46882\ps.ps1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

—

VCS antivirus.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows PowerShell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll

5164

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

—

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

7020

"C:\Users\admin\AppData\Local\Temp\VCS antivirus.exe"

C:\Users\admin\AppData\Local\Temp\VCS antivirus.exe

VCS antivirus.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\appdata\local\temp\vcs antivirus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

ims-api

(PID) Process(7020) VCS antivirus.exe

Telegram-Tokens (1)7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0

Telegram-Info-Links

7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0

Get info about bothttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/getMe

Get incoming updateshttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/getUpdates

Get webhookhttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/getWebhookInfo

Delete webhookhttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/deleteWebhook

Drop incoming updateshttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/deleteWebhook?drop_pending_updates=true

(PID) Process(7020) VCS antivirus.exe

Telegram-Tokens (1)7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0

Telegram-Info-Links

7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0

Get info about bothttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/getMe

Get incoming updateshttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/getUpdates

Get webhookhttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/getWebhookInfo

Delete webhookhttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/deleteWebhook

Drop incoming updateshttps://api.telegram.org/bot7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0/deleteWebhook?drop_pending_updates=true

Telegram-Requests

Token7457737016:AAEvv7iDxEzpd9bxMmY9BBwZM0rE2e9Yef0

End-PointsendMessage

Args

Telegram-Responses

oktrue

result

message_id573

from

id7457737016

is_bottrue

first_nametmqsuperbot_bot

usernametmqsuperbot_bot

chat

id1617506446

first_namepy

usernamepy0bf3c4t0r

typeprivate

date1747627877

textKey: Q1uFCmEC85EC4IAnaT1/mpVFbMMli4xyqfL/0HCQevs= IV: JbaGgeB5IYdrJYNldeXP9w==

has_protected_contenttrue

(PID) Process(7020) VCS antivirus.exe

Telegram-Responses

oktrue

result

message_id573

from

id7457737016

is_bottrue

first_nametmqsuperbot_bot

usernametmqsuperbot_bot

chat

id1617506446

first_namepy

usernamepy0bf3c4t0r

typeprivate

date1747627877

textKey: Q1uFCmEC85EC4IAnaT1/mpVFbMMli4xyqfL/0HCQevs= IV: JbaGgeB5IYdrJYNldeXP9w==

has_protected_contenttrue

Add for printing

Total events

4 800

Read events

4 800

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
4688	VCS antivirus.exe	C:\Users\admin\AppData\Local\Temp\_MEI46882\_decimal.pyd		executable
		MD5:E4E032221ACA4033F9D730F19DC3B21A	SHA256:23BDD07B84D2DBCB077624D6DCBFC66AB13A9EF5F9EEBE31DC0FFECE21B9E50C
4688	VCS antivirus.exe	C:\Users\admin\AppData\Local\Temp\_MEI46882\_queue.pyd		executable
		MD5:284FBC1B32F0282FC968045B922A4EE2	SHA256:AC3B144D7D7C8EE39F29D8749C5A35C4314B5365198821605C883FD11807E766
4688	VCS antivirus.exe	C:\Users\admin\AppData\Local\Temp\_MEI46882\_ssl.pyd		executable
		MD5:E5B1A076E9828985EA8EA07D22C6ABD0	SHA256:591589DADC659D1AD4856D16CD25DC8E57EAA085BF68EB2929F8F93ABA69DB1B
4688	VCS antivirus.exe	C:\Users\admin\AppData\Local\Temp\_MEI46882\api-ms-win-core-debug-l1-1-0.dll		executable
		MD5:33BBECE432F8DA57F17BF2E396EBAA58	SHA256:7CF0944901F7F7E0D0B9AD62753FC2FE380461B1CCE8CDC7E9C9867C980E3B0E
4688	VCS antivirus.exe	C:\Users\admin\AppData\Local\Temp\_MEI46882\api-ms-win-core-file-l1-2-0.dll		executable
		MD5:1C58526D681EFE507DEB8F1935C75487	SHA256:EF13DCE8F71173315DFC64AB839B033AB19A968EE15230E9D4D2C9D558EFEEE2
4688	VCS antivirus.exe	C:\Users\admin\AppData\Local\Temp\_MEI46882\api-ms-win-core-errorhandling-l1-1-0.dll		executable
		MD5:EB0978A9213E7F6FDD63B2967F02D999	SHA256:AB25A1FE836FC68BCB199F1FE565C27D26AF0C390A38DA158E0D8815EFE1103E
4688	VCS antivirus.exe	C:\Users\admin\AppData\Local\Temp\_MEI46882\api-ms-win-core-interlocked-l1-1-0.dll		executable
		MD5:C6024CC04201312F7688A021D25B056D	SHA256:8751D30DF554AF08EF42D2FAA0A71ABCF8C7D17CE9E9FF2EA68A4662603EC500
4688	VCS antivirus.exe	C:\Users\admin\AppData\Local\Temp\_MEI46882\api-ms-win-core-file-l1-1-0.dll		executable
		MD5:EFAD0EE0136532E8E8402770A64C71F9	SHA256:3D2C55902385381869DB850B526261DDEB4628B83E690A32B67D2E0936B2C6ED
4688	VCS antivirus.exe	C:\Users\admin\AppData\Local\Temp\_MEI46882\_hashlib.pyd		executable
		MD5:BA682DFCDD600A4BB43A51A0D696A64C	SHA256:2AD55E11BDDB5B65CDF6E9E126D82A3B64551F7AD9D4CBF74A1058FD7E5993BD
4688	VCS antivirus.exe	C:\Users\admin\AppData\Local\Temp\_MEI46882\api-ms-win-core-handle-l1-1-0.dll		executable
		MD5:E89CDCD4D95CDA04E4ABBA8193A5B492	SHA256:1A489E0606484BD71A0D9CB37A1DC6CA8437777B3D67BFC8C0075D0CC59E6238

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5496	MoUsoCoreWorker.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
—	—	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5496	MoUsoCoreWorker.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6544	svchost.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
4880	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
4880	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
—	—	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5496	MoUsoCoreWorker.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
—	—	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5496	MoUsoCoreWorker.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
—	—	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
3216	svchost.exe	172.211.123.248:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
7020	VCS antivirus.exe	185.199.111.133:443	raw.githubusercontent.com	FASTLY	US	whitelisted
7020	VCS antivirus.exe	13.107.253.45:443	download.sysinternals.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted

DNS requests

Domain	IP	Reputation
google.com	142.250.186.78	whitelisted
settings-win.data.microsoft.com	51.104.136.2	whitelisted
crl.microsoft.com	23.216.77.28 23.216.77.42 23.216.77.6	whitelisted
www.microsoft.com	184.30.21.171 95.101.149.131	whitelisted
client.wns.windows.com	172.211.123.248	whitelisted
raw.githubusercontent.com	185.199.111.133 185.199.109.133 185.199.110.133 185.199.108.133	whitelisted
download.sysinternals.com	13.107.253.45	whitelisted
login.live.com	40.126.31.71 20.190.159.64 40.126.31.73 40.126.31.131 40.126.31.69 20.190.159.130 40.126.31.2 40.126.31.130	whitelisted
ocsp.digicert.com	2.17.190.73	whitelisted
api.telegram.org	149.154.167.220	whitelisted

Threats

PID	Process	Class	Message
2196	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access raw user content on GitHub
2196	svchost.exe	Misc activity	ET HUNTING Telegram API Domain in DNS Lookup
7020	VCS antivirus.exe	Misc activity	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)

Add for printing

No debug info

General Info

VCS antivirus.exe

3EEEFAA309C8B93EFE5E99ECF85EA227

E0F6A44AB200A0A0A7959CCA664618B6B8E02797

EA5D1E2D0DDCC874CBFE969D7BF49E58F980BCE01501F4E8A53107A0DACFF736

98304:Nv7i+tfi42kGJsXukTemIMpYftHfktEzafhOsE+XZ0FdD1yTK4qVcYGCh1GJIbj1:Nrn2QJpZf7AktijSem866s55cm

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Uses AES cipher (POWERSHELL)

SUSPICIOUS

Process drops legitimate windows executable

Process drops python dynamic module

Executable content was dropped or overwritten

Application launched itself

The process drops C-runtime libraries

Loads Python modules

Get information on the list of running processes

The process executes Powershell scripts

Starts POWERSHELL.EXE for commands execution

Uses base64 encoding (POWERSHELL)

Creates file in the systems drive root

Process communicates with Telegram (possibly using it as an attacker's C2 server)

Gets content of a file (POWERSHELL)

Possible usage of Discord/Telegram API has been detected (YARA)

There is functionality for taking screenshot (YARA)

INFO

The sample compiled with english language support

Reads the computer name

Checks supported languages

Create files in a temporary directory

Checks whether the specified file exists (POWERSHELL)

Script raised an exception (POWERSHELL)

Uses string replace method (POWERSHELL)

Gets or sets the time when the file was last written to (POWERSHELL)

Checks proxy server information

PyInstaller has been detected (YARA)

Malware configuration

ims-api

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Malware configuration

ims-api

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings