Overview
overview
3Static
static
3Vega X Dev...ns.dll
windows10-2004-x64
1Vega X Dev...nd.bat
windows10-2004-x64
1Vega X Dev...dex.js
windows10-2004-x64
1Vega X Dev...in/ejs
windows10-2004-x64
1Vega X Dev...js.cmd
windows10-2004-x64
1Vega X Dev...js.ps1
windows10-2004-x64
1Vega X Dev...n/jake
windows10-2004-x64
1Vega X Dev...ke.cmd
windows10-2004-x64
1Vega X Dev...ke.ps1
windows10-2004-x64
1Vega X Dev...n/mime
windows10-2004-x64
1Vega X Dev...me.cmd
windows10-2004-x64
1Vega X Dev...me.ps1
windows10-2004-x64
1Vega X Dev...DME.js
windows10-2004-x64
1Vega X Dev...dex.js
windows10-2004-x64
1Vega X Dev...dex.js
windows10-2004-x64
1Vega X Dev...DME.js
windows10-2004-x64
1Vega X Dev...ten.js
windows10-2004-x64
1Vega X Dev...DME.js
windows10-2004-x64
1Vega X Dev...all.js
windows10-2004-x64
1Vega X Dev...mit.js
windows10-2004-x64
1Vega X Dev...ies.js
windows10-2004-x64
1Vega X Dev...any.js
windows10-2004-x64
1Vega X Dev...mit.js
windows10-2004-x64
1Vega X Dev...ies.js
windows10-2004-x64
1Vega X Dev...ply.js
windows10-2004-x64
1Vega X Dev...ach.js
windows10-2004-x64
1Vega X Dev...ies.js
windows10-2004-x64
1Vega X Dev...dex.js
windows10-2004-x64
1Vega X Dev...dex.js
windows10-2004-x64
1Vega X Dev...dex.js
windows10-2004-x64
1Vega X Dev...dex.js
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
Vega X Dev Mode/bin/FluxInteractions.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral2
Sample
Vega X Dev Mode/bin/commservice/files/StartCommand.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Vega X Dev Mode/bin/commservice/files/index.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/.bin/ejs
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/.bin/ejs.cmd
Resource
win10v2004-20231215-en
Behavioral task
behavioral6
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/.bin/ejs.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/.bin/jake
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/.bin/jake.cmd
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/.bin/jake.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/.bin/mime
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/.bin/mime.cmd
Resource
win10v2004-20240319-en
Behavioral task
behavioral12
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/.bin/mime.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/accepts/README.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/accepts/index.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/ansi-styles/index.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/array-flatten/README.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/array-flatten/array-flatten.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/async/README.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/async/all.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral20
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/async/allLimit.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/async/allSeries.js
Resource
win10v2004-20240319-en
Behavioral task
behavioral22
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/async/any.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/async/anyLimit.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/async/anySeries.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/async/apply.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/async/applyEach.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Vega X Dev Mode/bin/commservice/files/node_modules/async/applyEachSeries.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral28
Sample
Vega X Dev Mode/bin/commservice/node/node_modules/npm/node_modules/ssri/lib/index.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
Vega X Dev Mode/bin/commservice/node/node_modules/npm/node_modules/string-width-cjs/index.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral30
Sample
Vega X Dev Mode/bin/commservice/node/node_modules/npm/node_modules/string-width-cjs/node_modules/ansi-regex/index.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Vega X Dev Mode/bin/commservice/node/node_modules/npm/node_modules/string-width-cjs/node_modules/strip-ansi/index.js
Resource
win10v2004-20240226-en
General
-
Target
Vega X Dev Mode/bin/FluxInteractions.dll
-
Size
6.2MB
-
MD5
cdf73079a63074805810016f13fbbfce
-
SHA1
f7ecbbd392820ea6fb8cbc72911325c440c0c271
-
SHA256
c1eb4052b0a9d672595be10d21ff60a79039c5842d8c98e837251a721549c60b
-
SHA512
2eb5a41dfe01d6b58aba5d27a4b359f8b6ea2b913e465ca839f09b3c334aabe550d4925a6e786540a5c28c9086ed97b2187722f3bf62c54ae92922550f5e36e9
-
SSDEEP
98304:ff0ldnefVuuvtLonWJ7gatg6QrkP6G9qvPpZDI0evx+AquS/gdV7Wme+OEDl:kH6tvP613pZkvquddNLhOW
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4660 rundll32.exe 4660 rundll32.exe 4660 rundll32.exe 4660 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3968 wrote to memory of 4660 3968 rundll32.exe 100 PID 3968 wrote to memory of 4660 3968 rundll32.exe 100 PID 3968 wrote to memory of 4660 3968 rundll32.exe 100
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Vega X Dev Mode\bin\FluxInteractions.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Vega X Dev Mode\bin\FluxInteractions.dll",#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2288,i,10301911031503898037,2997280636231771547,262144 --variations-seed-version /prefetch:81⤵PID:4400