File name:

VagLogins-Installer.exe

Full analysis: https://app.any.run/tasks/496a1a97-028c-4d08-bec9-e3aeda7a7532
Verdict: Malicious activity
Analysis date: May 09, 2024, 15:42:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

BE601A0B83481610A36AEE5689F0E387

SHA1:

471DE61854B08DE58A4A626A7517636B350286CA

SHA256:

A127135987552F0BFD96EF65366741D2D1EDDA18A220A5AABB24930086047A87

SSDEEP:

98304:HWQz2DggnqCjAaf/L13rxpJjRunse7BwEiplxvXsYy3AfSHmwkynM1b5H7BLufC6:iYDDP5ArRs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VagLogins-Installer.exe (PID: 4088)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • VagLogins-Installer.exe (PID: 4088)

    • Mutex name with non-standard characters

      • VagLogins-Installer.exe (PID: 4088)

    • Creates a software uninstall entry

      • VagLogins-Installer.exe (PID: 4088)

    • Starts CMD.EXE for commands execution

      • VagLogins.exe (PID: 972)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 3948)

  • INFO

    • Reads the computer name

      • VagLogins-Installer.exe (PID: 4088)
      • VagLogins.exe (PID: 2024)
      • VagLogins.exe (PID: 972)

    • Checks supported languages

      • VagLogins-Installer.exe (PID: 4088)
      • VagLogins.exe (PID: 2024)
      • VagLogins.exe (PID: 972)

    • Creates files or folders in the user directory

      • VagLogins-Installer.exe (PID: 4088)

    • Manual execution by a user

      • VagLogins.exe (PID: 972)
      • VagLogins.exe (PID: 2024)

    • Create files in a temporary directory

      • VagLogins.exe (PID: 972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:11 14:38:32+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 16384
InitializedDataSize: 8192
UninitializedDataSize: 40960
EntryPoint: 0xe860
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vaglogins-installer.exe vaglogins.exe no specs vaglogins.exe cmd.exe no specs ipconfig.exe no specs vaglogins-installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
972"C:\Users\admin\Desktop\VagLogins\VagLogins.exe" C:\Users\admin\Desktop\VagLogins\VagLogins.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Version:
1.1.33.00
Modules
Images
c:\users\admin\desktop\vaglogins\vaglogins.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2024"C:\Users\admin\Desktop\VagLogins\VagLogins.exe" C:\Users\admin\Desktop\VagLogins\VagLogins.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.1.33.00
Modules
Images
c:\users\admin\desktop\vaglogins\vaglogins.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3808ipconfig /all C:\Windows\System32\ipconfig.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
3948C:\Windows\system32\cmd.exe /c ipconfig /all > C:\Users\admin\AppData\Local\Temp\mac.txtC:\Windows\System32\cmd.exe—VagLogins.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3984"C:\Users\admin\AppData\Local\Temp\VagLogins-Installer.exe" C:\Users\admin\AppData\Local\Temp\VagLogins-Installer.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\vaglogins-installer.exe
c:\windows\system32\ntdll.dll
4088"C:\Users\admin\AppData\Local\Temp\VagLogins-Installer.exe" C:\Users\admin\AppData\Local\Temp\VagLogins-Installer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\vaglogins-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
2 956
Read events
2 951
Write events
5
Delete events
0

Modification events

(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Width
Value:
318
(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Height
Value:
288
(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VagLogins
Operation:writeName:DisplayName
Value:
VagLogins
(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VagLogins
Operation:writeName:UninstallString
Value:
C:\Users\admin\Desktop\VagLogins\Uninstall.exe
Executable files
8
Suspicious files
3
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\config.exeexecutable
MD5:74477D546941798183CDDD7728B9A516
SHA256:A8DA34CC55924F8CE1BD84698D031F54CA09F173D518E76C1668274CEFB03E57
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Helper64.exeexecutable
MD5:F31A68F82B76E14E097BD2EE6161A36D
SHA256:AD0C6EE03AE8F82B2512DA839BB89C1D2A28416189B71262D8ED2B3218DB7F5D
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\VagLogins.exeexecutable
MD5:62792918F43848B9E46C4A27BBC0DB9A
SHA256:EA8B39ED433F947D9922116BF14A1ECCAA183AFDC2BF8F4B2BA4A685E6A806BE
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\PrxDrv.dllbinary
MD5:DB2561D8131BCAD52B1B6C7603BBBF2D
SHA256:12D950785C7A611866C74C086AE5730F3031FB97C878A902BF6B175FB97AB933
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Profiles\Proxy1-123.ppxxml
MD5:6938319549FCF3861D2EEABEC5FC8811
SHA256:AA571187AB63F8E32597702F1A99027060438B6F8EABF83B08B81448FBF17100
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Profiles\Default.ppxxml
MD5:46C061890752CC71663FBB523B74823B
SHA256:D037EC8657D5A02D094946D21E9E88137181A1956014E1D7934AEB186000ED5F
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Settings.initext
MD5:9EDAD2B7275F9DF75271A84FA5DBE0FB
SHA256:2B1A22BC828ED2A4B186FAD2167947187FCF6F1DA3F8329A3A8B50E860499522
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Helpa.iniimage
MD5:D7819A2D993EBACB77B20844B39C947A
SHA256:B1C427ED8F952F7E169B1EBB6A53D0985D1520DCEA72444F024B5432BEF091AD
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\PrxDrvPE64.dllexecutable
MD5:282781C0D07D041CAECEC93875818DE8
SHA256:8B61FF14A7D428B4A87A2B36375EFF05534F90D4A3DD14DD4742977681339046
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Uninstall.exeexecutable
MD5:7A21D7592AF641B41213D1E0963F0BBC
SHA256:BCC41A8AB492AF66FC0E22912C5D73DA90A3F0822FE88F163948B1668A8722FC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
VagLogins-Installer.exe