Analysis
- max time kernel
299s - max time network
292s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 09:28
General
- Target Purchase Order- EE2607-3163 -July-17-2026..js
- Size 1.2MB
- Sample260718-lfdensfs5n
- SHA256 2f7404419039fc2f57f8442e3de6eb24abebefdbd8aba5c61e41e8247fbb9a09
Malware Config
Extracted
-
lxbaserat
-
1.0.20
-
July-17-2026
-
67d58c4fd2364ff6b926dd4713fbb545
-
purchaseorder.ydns.eu:4525
-
directory
WindowsTelemetry\Logs
-
executable
client.exe
-
password
A5ACk6jyeARF388i40NV
Signatures
- Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase Order- EE2607-3163 -July-17-2026..js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "PhotoStudioJS" /xml "C:\Users\Admin\AppData\Local\Temp\Task_5053.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w 1 -nop -ex unrestricted -f "C:\Users\Admin\AppData\Local\Temp\cfg_60077_2c92.ps1"1⤵
- Process spawned unexpected child process
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\reqdd43u\reqdd43u.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE7B6.tmp" "c:\Users\Admin\AppData\Local\Temp\reqdd43u\CSC5909C62563EF4F258E347DDDE2EF13C4.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESE7B6.tmp
Task_5053.xml
cfg_60077_2c92.ps1
reqdd43u.dll
CSC5909C62563EF4F258E347DDDE2EF13C4.TMP
reqdd43u.0.cs
reqdd43u.cmdline
memory/2296-35-0x0000000000400000-0x000000000047C000-memory.dmp
memory/4940-11-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-33-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-12-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-19-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-10-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-39-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-29-0x0000026A6E360000-0x0000026A6E368000-memory.dmp
memory/4940-5-0x0000026A6E380000-0x0000026A6E3A2000-memory.dmp
memory/4940-27-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-30-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-31-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-6-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-32-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-13-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-34-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-4-0x00007FF90828F000-0x00007FF908290000-memory.dmp
memory/4940-37-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/4940-38-0x00007FF908100000-0x00007FF908AA4000-memory.dmp
memory/5880-26-0x000001FD02090000-0x000001FD02A34000-memory.dmp