Technical Information
Malicious functions
Injects code into
the following user processes:
- chrome.exe
Patches code
in dll
- ldjklk.exe process, WINMM.dll module
Modifies file system
Creates the following files
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cookies.sqlite-shm
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\places.sqlite-shm
Modifies the following files
Network activity
Connects to
- 'ba###yemas.com':443
- 'x1.#.lencr.org':80
- 'ip##pi.com':80
- '2.##.62.140':4449
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://ip##pi.com/line/?fi################
Other
- 'ba###yemas.com':443
- '2.##.62.140':4449
UDP
- DNS ASK ba###yemas.com
- DNS ASK x1.#.lencr.org
- DNS ASK ip##pi.com
Miscellaneous
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --headless --disable-gpu --no-first-run --noerrdialogs --no-sandbox
- '%LOCALAPPDATA%\google\chrome\application\chrome.exe' --headless=new --load-extension="%TEMP%\rext_3132_1033031" --disable-extensions-except="%TEMP%\rext_3132_1033031" --no-first-run --no-default-browser-check --profile-directory="Default" --windo...' (with hidden window)
