File name:

VagLogins-Installer.exe

Full analysis: https://app.any.run/tasks/496a1a97-028c-4d08-bec9-e3aeda7a7532
Verdict: Malicious activity
Analysis date: May 09, 2024, 15:42:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

BE601A0B83481610A36AEE5689F0E387

SHA1:

471DE61854B08DE58A4A626A7517636B350286CA

SHA256:

A127135987552F0BFD96EF65366741D2D1EDDA18A220A5AABB24930086047A87

SSDEEP:

98304:HWQz2DggnqCjAaf/L13rxpJjRunse7BwEiplxvXsYy3AfSHmwkynM1b5H7BLufC6:iYDDP5ArRs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VagLogins-Installer.exe (PID: 4088)

  • SUSPICIOUS

    • Mutex name with non-standard characters

      • VagLogins-Installer.exe (PID: 4088)

    • Creates a software uninstall entry

      • VagLogins-Installer.exe (PID: 4088)

    • Executable content was dropped or overwritten

      • VagLogins-Installer.exe (PID: 4088)

    • Starts CMD.EXE for commands execution

      • VagLogins.exe (PID: 972)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 3948)

  • INFO

    • Reads the computer name

      • VagLogins-Installer.exe (PID: 4088)
      • VagLogins.exe (PID: 2024)
      • VagLogins.exe (PID: 972)

    • Checks supported languages

      • VagLogins-Installer.exe (PID: 4088)
      • VagLogins.exe (PID: 2024)
      • VagLogins.exe (PID: 972)

    • Creates files or folders in the user directory

      • VagLogins-Installer.exe (PID: 4088)

    • Manual execution by a user

      • VagLogins.exe (PID: 972)
      • VagLogins.exe (PID: 2024)

    • Create files in a temporary directory

      • VagLogins.exe (PID: 972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:11 14:38:32+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 16384
InitializedDataSize: 8192
UninitializedDataSize: 40960
EntryPoint: 0xe860
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vaglogins-installer.exe vaglogins.exe no specs vaglogins.exe cmd.exe no specs ipconfig.exe no specs vaglogins-installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
972"C:\Users\admin\Desktop\VagLogins\VagLogins.exe" C:\Users\admin\Desktop\VagLogins\VagLogins.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Version:
1.1.33.00
Modules
Images
c:\users\admin\desktop\vaglogins\vaglogins.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2024"C:\Users\admin\Desktop\VagLogins\VagLogins.exe" C:\Users\admin\Desktop\VagLogins\VagLogins.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.1.33.00
Modules
Images
c:\users\admin\desktop\vaglogins\vaglogins.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3808ipconfig /all C:\Windows\System32\ipconfig.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
3948C:\Windows\system32\cmd.exe /c ipconfig /all > C:\Users\admin\AppData\Local\Temp\mac.txtC:\Windows\System32\cmd.exe—VagLogins.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3984"C:\Users\admin\AppData\Local\Temp\VagLogins-Installer.exe" C:\Users\admin\AppData\Local\Temp\VagLogins-Installer.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\vaglogins-installer.exe
c:\windows\system32\ntdll.dll
4088"C:\Users\admin\AppData\Local\Temp\VagLogins-Installer.exe" C:\Users\admin\AppData\Local\Temp\VagLogins-Installer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\vaglogins-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
2 956
Read events
2 951
Write events
5
Delete events
0

Modification events

(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Width
Value:
318
(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Height
Value:
288
(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VagLogins
Operation:writeName:DisplayName
Value:
VagLogins
(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VagLogins
Operation:writeName:UninstallString
Value:
C:\Users\admin\Desktop\VagLogins\Uninstall.exe
Executable files
8
Suspicious files
3
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\config.exeexecutable
MD5:74477D546941798183CDDD7728B9A516
SHA256:A8DA34CC55924F8CE1BD84698D031F54CA09F173D518E76C1668274CEFB03E57
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Proxifier.exeexecutable
MD5:EF816ADF6E8FF8B341950847784770AA
SHA256:F4C9C37D7B007E3F5AE08EEE78422DCCF2945802F1B3378999C59AAEBF180026
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Profiles\Proxy1-123.ppxxml
MD5:6938319549FCF3861D2EEABEC5FC8811
SHA256:AA571187AB63F8E32597702F1A99027060438B6F8EABF83B08B81448FBF17100
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Settings.initext
MD5:9EDAD2B7275F9DF75271A84FA5DBE0FB
SHA256:2B1A22BC828ED2A4B186FAD2167947187FCF6F1DA3F8329A3A8B50E860499522
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Profiles\Proxy2-123.ppxxml
MD5:94A3726D5B2B0AB99D360FCC60DC2703
SHA256:C078DAB2AE49F9F80C941F0821D4DF9E8663AE8DFF3E2D0AD2E3B5CE34516BA7
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Profiles\Default.ppxxml
MD5:46C061890752CC71663FBB523B74823B
SHA256:D037EC8657D5A02D094946D21E9E88137181A1956014E1D7934AEB186000ED5F
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\tick.iniimage
MD5:9C50386B7BE3BDA90CBD5AFE70F4929F
SHA256:4B43862C4616E8CE204D8C419A8433A797ECB9F4CCAE729ACED064743067CC8C
3948cmd.exeC:\Users\admin\AppData\Local\Temp\mac.txttext
MD5:16EF1CB042AECC6BE0105693FB1B7FF5
SHA256:D6EAD2934A4D90540045200A83F7AC39C0CFFB7116F2BAABB38C91DD10561FA3
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins.lnkbinary
MD5:E2CE7987032CCC0B779A5D9E88308196
SHA256:EBA70B8CAD8EF45163A48F45BE05701008A732F5A0C14004EE0E848E9065625D
972VagLogins.exeC:\Users\admin\AppData\Local\Temp\ud.txttext
MD5:5957B59B3B33DBF65C5F66AECB0394F7
SHA256:6C6596953182FEFF2072EC3323E47774B5D6FC3871891F9DAE2DA7F1103EC135
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VagLogins-Installer.exe