Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Environment] 'UserInitMprLogonScript' = '<Full path to file>'
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoftwindowsaudioupdate
Malicious functions
Patches code
in AMSI dll
- wcnqznoc.exe process, Amsi.dll module
in NTDLL dll
- wcnqznoc.exe process, ntdll.dll module
Network activity
Connects to
- 'nj#########production.up.railway.app':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'nj#########production.up.railway.app':443
UDP
- DNS ASK nj#########production.up.railway.app
- DNS ASK x1.#.lencr.org
