lxbaserat | 456070983c4e53a2c116351645d5cde1deb69045d8266c1eb6c02ed8f0723f55

Analysis

max time kernel
298s
max time network
303s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Заказ_17954103027072026_Azotny Zavod LLP.js
Size 1.8MB
Sample260727-tsnp6shr3t
SHA256 456070983c4e53a2c116351645d5cde1deb69045d8266c1eb6c02ed8f0723f55
MD5 c25824315d751ab5b8170c2bd3f2248e
SHA1 c865178983e4d1cf0601b33041693dd13a0afbce
SHA512 1e0dfe39755b56a5c053c533f77f4779c9cd265671b529ff0c9882c3b374f7399d82e5af4806a69c5bc821566eea0541f668f4f3980d1954b6a00d232671eb77
SSDEEP 24576:Qf8jAp+qbTXs04dJxU3E6BMusGYldCrFt0hJZjFfySbJQyKb3/NWv+cpfVUC9l7Z:OsSurGYYFOL+Tex9
TLSH
T156959FCD30B2ED3E2A1C36303CCAB240BDFCB6D750A5A643796E76528D562E354A643D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

july-27-2026 1fe693fc62a34f46804dc3d81389e752 execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.22

Botnet

JULY-27-2026

Campaign

1fe693fc62a34f46804dc3d81389e752

lxrrxl.ydns.eu:4521

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
DrI4raDA2NxA5tFHiluY

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4744	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4648	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4744 set thread context of 2616	4744	powershell.exe	95

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4744	powershell.exe
4744	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4744	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4648	4352	wscript.exe	90
PID 4648 wrote to memory of 4744	4648	wscript.exe	91
PID 4744 wrote to memory of 4892	4744	powershell.exe	93
PID 4892 wrote to memory of 5036	4892	csc.exe	94
PID 4744 wrote to memory of 2616	4744	powershell.exe	95
PID 4744 wrote to memory of 2616	4744	powershell.exe	95
PID 4744 wrote to memory of 2616	4744	powershell.exe	95
PID 4744 wrote to memory of 2616	4744	powershell.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Заказ_17954103027072026_Azotny Zavod LLP.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\n7tai3er\dat_11849_a8.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\n7tai3er\dat_51033_8b.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\guuvtlfg\guuvtlfg.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E26.tmp" "c:\Users\Admin\AppData\Local\Temp\guuvtlfg\CSCC1247EAD5B364CF68E1852F6AC664AED.TMP"
        5⤵
        
        PID:5036
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      4⤵
      PID:2616

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES2E26.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2E26.tmp
Size 1KB
SHA256 1e2397e52e9962fd2a7201d8f3fbdee6e8484362a7f40167c0bc6ab0a255e9a1
MD5 7218319d0ed309969448254fdd3a8c6a
SHA1 791bcb84da5e1e0e52a9c0ef1556201c07b7421e
SHA512 7bd9ab5f1764453967f9d24a2433cea88404a09ab7d8aac93ea622649c225d309e4b74679cd1d1eb949d6504d9be108fe5d22833ac4401ab356800cb352cb8f7
TLSH
T1BC21CC0593EC471EF0774732ADF5171FA135FD99EFA2A36B444042281C51104EEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

guuvtlfg.dll

Path C:\Users\Admin\AppData\Local\Temp\guuvtlfg\guuvtlfg.dll
Size 3KB
SHA256 28f5d001537bfe15341052692248a86a4ea21240bd60f8973cf7d6e65e858fa4
MD5 390afca81b95cbccccc95b89934a2870
SHA1 92e4c080331dbac93bf888ab8e484c74e8e815ce
SHA512 ed7ee2584c677c1dd7fea8b7a8a11e072d430d78759f8bdd0f23136d1e4d63af7f2eeb59b82c54c853de95b527799657f4cf6bb45daca9a3ca8968aa3a26a340
TLSH
T16651CB0A97E8462BF0730B316EF3432637B5F8508BB3A75E0D905268AC606644E21FB0
MD5 SHA1 SHA512 TLSH

Submit Download

dat_11849_a8.vbs

Path C:\Users\Admin\AppData\Local\Temp\n7tai3er\dat_11849_a8.vbs
Size 226B
SHA256 90acb5983c25decfed2b36c3dd87f8ff62fd06d10e13ee9456f83b8967d6530a
MD5 d1b463bf9c75264ef726bbec3ff45cb6
SHA1 9ffcfb57e11504a63f92eb21d3387ee58934c1f4
SHA512 9860ed6fd055ac2cd9d6aa99eea2b3640f0146653a48c448ba12bc4d43f9018c3af00d9e56bcda0c3624a7ec2f98bc02ec18bf8656ac1b3f16c9aa85092178b9
TLSH
T147D09700623AE20CCC25C53E00E2822C889358D82200175063608484F681169CAAA14A
MD5 SHA1 SHA512 TLSH

Submit Download

dat_51033_8b.ps1

Path C:\Users\Admin\AppData\Local\Temp\n7tai3er\dat_51033_8b.ps1
Size 5KB
SHA256 8f83aa5fa5d69e11c9355c3365ead11a8e8025587a9f3a8391dacc33d4686143
MD5 783ad3c6265454776245c23a9e00ab1d
SHA1 3808756dfec1ac7074eeead28680a3b71aa8d43e
SHA512 5995da1fa4535b0e573ca4846f16192a6621b260e0a725ec547b93d2bf0f05d7496dcbf67696bf9f40ab33a9e07c7334279d83c53b773105da609fc68071b2a1
SSDEEP 96:aJc2uFij/f5SNl8f5oZiLGIoBYSKhwwDzm8CgrcXqbHeV9oulDV8ohYO:mgij/fMNl8f6IqIomSKh3mWrXr8bF/
TLSH
T10CB18146BBDA43F902C3546449B31A52B679D42B294F1D04F2FDC2CDBF06470D2E21AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_96950_8a

Path C:\Users\Admin\AppData\Local\Temp\n7tai3er\log_96950_8a
Size 805KB
SHA256 8ba1c75e10c035761b765c38b8ecd510efaef9c4991bbdf9773b0c5df77bb8d4
MD5 538a0a3b19afe4336b2e78d26cf52047
SHA1 bace0515cdda54d64b54621278d7f66a13e75069
SHA512 0accd5ad6d550b15841bec7a1e2c316d7686d9f88e2251aa38911770e0aef8b5eddbc597680e1b71b29bfa9ff09a9e3c9edded99d7c744572eb689360b93d6b4
SSDEEP 24576:E8i4C0fyACdZZ+BYzZKyMjE/3Ilw0+co8f4ex:Qdl6IZcb
TLSH
T19B0512098526CE1EDAD8165C34BD1FC837F01D984474FBE389BAB4A329E653730A74A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_33118_89

Path C:\Users\Admin\AppData\Local\Temp\n7tai3er\net_33118_89
Size 79KB
SHA256 3614f81a0f8c5403cc874ee4062d20894b84b37ac3bb5cbc2dca2d281022c442
MD5 15dfa7b0cdf432af24a7aa688f6575ed
SHA1 81083669141f5a56e8d192bef5f8db11dba88b2c
SHA512 6ae68e13c8a502f7c6776dd384b724593c7f05cf68eb1a4dab504a512a9baa626f5f244b69419845a2d31128a81d88c5043904afd26c24b94b88c199ad0148cb
SSDEEP 1536:13fc08dNhvd9sLTSHbqY1sisiB10HiRL+/r9+PE4hq942dX18PuKzTEo8MPcF2MP:13vAhvLsLTSbFoiP0HGyj9EDq94sKPlw
TLSH
T173830247421F9868C29916F9282B2EC837E0057414B4BB1AE27ED83776E737F20BA55D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCC1247EAD5B364CF68E1852F6AC664AED.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\guuvtlfg\CSCC1247EAD5B364CF68E1852F6AC664AED.TMP
Size 652B
SHA256 5a030ca2cf5a7a770d21d6ab89689af341d54f2757d27fa5c27a5d7c81a33070
MD5 e77ba393bbf0e801ee6a9cd7ae24bb42
SHA1 42dac4535b1459565f954912282e5badb4e17df5
SHA512 004e9dc4e1ebc28d63886108a0c8af17cff5d5e9e697138b5c2456fd609db83c9ec529bb379b5856f7d6102fb91592cf674c28c3a55ef8cf879dab850f76c861
TLSH
T103F05E49A3F8020EF1F34B31BDF6436391AAFC66DE3293EE1440136D286451089A2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

guuvtlfg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guuvtlfg\guuvtlfg.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

guuvtlfg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\guuvtlfg\guuvtlfg.cmdline
Size 369B
SHA256 c535d7be2369193ceb14214c84f15462c09f97bf223937c65df7185964eb6844
MD5 2a510659443e315b726a0dd6557952bb
SHA1 a6f115fb54caae855320056ec678931cace77a88
SHA512 24850f6a4a585936d706a478607b060a7711d1a46d3d937e371f95918c824f0e0079823886a886f2a39780d7f68f0e9646d656448847a482a29e1758b988a42d
TLSH
T154E0C06E4256C6FD01FD110B35F9E7ACC272178B2A803F84504C843DD0170042FF1B45
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2616-27-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/4744-12-0x0000017DBB680000-0x0000017DBB692000-memory.dmp

Download

memory/4744-25-0x0000017DBB960000-0x0000017DBB968000-memory.dmp

Download

memory/4744-6-0x0000017DBB6A0000-0x0000017DBB6C2000-memory.dmp

Download

memory/4744-26-0x0000017DBB970000-0x0000017DBB978000-memory.dmp

Download