Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\dllhost.exe
the following user processes:
- firefox.exe
- msedge.exe
Patches code
in NTDLL dll
- dllhost.exe process, ntdll.dll module
Network activity
Connects to
- 't.#e':443
- 'se####vernous.com':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'se####vernous.com':443
UDP
- DNS ASK t.#e
- DNS ASK se####vernous.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Executes the following
- '<SYSTEM32>\dllhost.exe'
- '%ProgramFiles%\mozilla firefox\firefox.exe' --headless --incognito
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --headless --disable-gpu
