Technical Information
Malicious functions
Injects code into
the following user processes:
- firefox.exe
- msedge.exe
Intercepts control using hardware breakpoints
in AMSI dll
- scysnc.exe process, Amsi.dll module
in NTDLL dll
- scysnc.exe process, ntdll.dll module
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\~tmp5ac9.dat
Network activity
Connects to
- 't.#e':443
- 'se####vernous.com':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'se####vernous.com':443
UDP
- DNS ASK t.#e
- DNS ASK se####vernous.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'WinDbgFrameClass' WindowName: ''
- ClassName: 'x64dbg' WindowName: ''
- ClassName: 'ImmunityDebugger' WindowName: ''
Executes the following
- '%ProgramFiles%\mozilla firefox\firefox.exe' --headless --incognito
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --headless --disable-gpu
