Technical Information
Malicious functions
Injects code into
the following user processes:
- msedge.exe
- firefox.exe
Patches code
in NTDLL dll
- qovxo.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\~tmpb7f3.dat
- %TEMP%\~tmp976f.dat
- %TEMP%\~tmp4cc1.dat
- %TEMP%\~tmp82b3.dat
- %TEMP%\~tmp82e6.dat
- %TEMP%\~tmpddc8.dat
Network activity
Connects to
- 't.#e':443
- 'se####vernous.com':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'se####vernous.com':443
UDP
- DNS ASK t.#e
- DNS ASK se####vernous.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --headless --incognito
- '%ProgramFiles%\mozilla firefox\firefox.exe' --headless --disable-gpu
