File name:

VagLogins-Installer.exe

Full analysis: https://app.any.run/tasks/496a1a97-028c-4d08-bec9-e3aeda7a7532
Verdict: Malicious activity
Analysis date: May 09, 2024, 15:42:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

BE601A0B83481610A36AEE5689F0E387

SHA1:

471DE61854B08DE58A4A626A7517636B350286CA

SHA256:

A127135987552F0BFD96EF65366741D2D1EDDA18A220A5AABB24930086047A87

SSDEEP:

98304:HWQz2DggnqCjAaf/L13rxpJjRunse7BwEiplxvXsYy3AfSHmwkynM1b5H7BLufC6:iYDDP5ArRs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VagLogins-Installer.exe (PID: 4088)

  • SUSPICIOUS

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 3948)

    • Mutex name with non-standard characters

      • VagLogins-Installer.exe (PID: 4088)

    • Creates a software uninstall entry

      • VagLogins-Installer.exe (PID: 4088)

    • Starts CMD.EXE for commands execution

      • VagLogins.exe (PID: 972)

    • Executable content was dropped or overwritten

      • VagLogins-Installer.exe (PID: 4088)

  • INFO

    • Checks supported languages

      • VagLogins-Installer.exe (PID: 4088)
      • VagLogins.exe (PID: 972)
      • VagLogins.exe (PID: 2024)

    • Reads the computer name

      • VagLogins-Installer.exe (PID: 4088)
      • VagLogins.exe (PID: 2024)
      • VagLogins.exe (PID: 972)

    • Creates files or folders in the user directory

      • VagLogins-Installer.exe (PID: 4088)

    • Manual execution by a user

      • VagLogins.exe (PID: 2024)
      • VagLogins.exe (PID: 972)

    • Create files in a temporary directory

      • VagLogins.exe (PID: 972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:11 14:38:32+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 16384
InitializedDataSize: 8192
UninitializedDataSize: 40960
EntryPoint: 0xe860
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vaglogins-installer.exe vaglogins.exe no specs vaglogins.exe cmd.exe no specs ipconfig.exe no specs vaglogins-installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
972"C:\Users\admin\Desktop\VagLogins\VagLogins.exe" C:\Users\admin\Desktop\VagLogins\VagLogins.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Version:
1.1.33.00
Modules
Images
c:\users\admin\desktop\vaglogins\vaglogins.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2024"C:\Users\admin\Desktop\VagLogins\VagLogins.exe" C:\Users\admin\Desktop\VagLogins\VagLogins.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.1.33.00
Modules
Images
c:\users\admin\desktop\vaglogins\vaglogins.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3808ipconfig /all C:\Windows\System32\ipconfig.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
3948C:\Windows\system32\cmd.exe /c ipconfig /all > C:\Users\admin\AppData\Local\Temp\mac.txtC:\Windows\System32\cmd.exe—VagLogins.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3984"C:\Users\admin\AppData\Local\Temp\VagLogins-Installer.exe" C:\Users\admin\AppData\Local\Temp\VagLogins-Installer.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\vaglogins-installer.exe
c:\windows\system32\ntdll.dll
4088"C:\Users\admin\AppData\Local\Temp\VagLogins-Installer.exe" C:\Users\admin\AppData\Local\Temp\VagLogins-Installer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\vaglogins-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
2 956
Read events
2 951
Write events
5
Delete events
0

Modification events

(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Width
Value:
318
(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Height
Value:
288
(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VagLogins
Operation:writeName:DisplayName
Value:
VagLogins
(PID) Process:(4088) VagLogins-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VagLogins
Operation:writeName:UninstallString
Value:
C:\Users\admin\Desktop\VagLogins\Uninstall.exe
Executable files
8
Suspicious files
3
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\VagLogins.exeexecutable
MD5:62792918F43848B9E46C4A27BBC0DB9A
SHA256:EA8B39ED433F947D9922116BF14A1ECCAA183AFDC2BF8F4B2BA4A685E6A806BE
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Helpa.iniimage
MD5:D7819A2D993EBACB77B20844B39C947A
SHA256:B1C427ED8F952F7E169B1EBB6A53D0985D1520DCEA72444F024B5432BEF091AD
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Helper64.exeexecutable
MD5:F31A68F82B76E14E097BD2EE6161A36D
SHA256:AD0C6EE03AE8F82B2512DA839BB89C1D2A28416189B71262D8ED2B3218DB7F5D
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Proxifier.exeexecutable
MD5:EF816ADF6E8FF8B341950847784770AA
SHA256:F4C9C37D7B007E3F5AE08EEE78422DCCF2945802F1B3378999C59AAEBF180026
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Profiles\Proxy2-123.ppxxml
MD5:94A3726D5B2B0AB99D360FCC60DC2703
SHA256:C078DAB2AE49F9F80C941F0821D4DF9E8663AE8DFF3E2D0AD2E3B5CE34516BA7
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\tick.iniimage
MD5:9C50386B7BE3BDA90CBD5AFE70F4929F
SHA256:4B43862C4616E8CE204D8C419A8433A797ECB9F4CCAE729ACED064743067CC8C
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\Profiles\Proxy1-123.ppxxml
MD5:6938319549FCF3861D2EEABEC5FC8811
SHA256:AA571187AB63F8E32597702F1A99027060438B6F8EABF83B08B81448FBF17100
4088VagLogins-Installer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\VagLogins.lnklnk
MD5:855452069912629A709037AAF1CB7374
SHA256:3F34B4750C2DC2F2FC2050ED2687E3F674DABFD36D18C5037FB02FFB259F08ED
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins\Proxi\PrxDrvPE64.dllexecutable
MD5:282781C0D07D041CAECEC93875818DE8
SHA256:8B61FF14A7D428B4A87A2B36375EFF05534F90D4A3DD14DD4742977681339046
4088VagLogins-Installer.exeC:\Users\admin\Desktop\VagLogins.lnkbinary
MD5:E2CE7987032CCC0B779A5D9E88308196
SHA256:EBA70B8CAD8EF45163A48F45BE05701008A732F5A0C14004EE0E848E9065625D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VagLogins-Installer.exe