lxbaserat | 0d1f96a91f041b01b95cbd79234cdf6359f3d831ecd90c135e8c2a3c2b8ead58

Analysis

max time kernel
298s
max time network
162s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PESANAN BARU.js
Size 1.3MB
Sample260729-edefmagj7v
SHA256 0d1f96a91f041b01b95cbd79234cdf6359f3d831ecd90c135e8c2a3c2b8ead58
MD5 5507f9fd5cd04eb0ecf8103ca42a7a50
SHA1 c8f99c667ee385e3d0d3e88affffb67b1f078964
SHA512 98086dfcc9ec0bba4a93c1651e5d2341a8b80369604e27758f8a21a01b0f48a042b58d6d0dfc8867acecd2cbeac5b258f318b48f8e38a0464990af56c2c1bde1
SSDEEP 24576:RV7+6rQOvG4WjESC0JMLb8rAD00cROmFddpwrZ4WyFq+BGOURChZj7kFnVIr3zBA:bdewSybsAGnf58k1r3zHa
TLSH
T1D3557DF0709475C899FF9F44D0ECBBAE43B2366518023D0BA58621B61F62FAEE14257D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 c7c2ba12f49340c3a0557870e4c40884 execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.22

Botnet

Group1

Campaign

c7c2ba12f49340c3a0557870e4c40884

64.89.160.127:4561

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
E0kG2kJE4bTtaLTZEXSx

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4776	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
6088	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4776 set thread context of 6048	4776	powershell.exe	96

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4776	powershell.exe
4776	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 6088	2584	wscript.exe	91
PID 6088 wrote to memory of 4776	6088	wscript.exe	92
PID 4776 wrote to memory of 5932	4776	powershell.exe	94
PID 5932 wrote to memory of 2476	5932	csc.exe	95
PID 4776 wrote to memory of 6048	4776	powershell.exe	96
PID 4776 wrote to memory of 6048	4776	powershell.exe	96
PID 4776 wrote to memory of 6048	4776	powershell.exe	96
PID 4776 wrote to memory of 6048	4776	powershell.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PESANAN BARU.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\tc0sa1hd\cfg_102265_d729.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\tc0sa1hd\net_58407_d718.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kzrq2okd\kzrq2okd.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5932
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA7EE.tmp" "c:\Users\Admin\AppData\Local\Temp\kzrq2okd\CSC353F7D1841EB4338AA9B5DEF94AB2C60.TMP"
        5⤵
        
        PID:2476
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
      4⤵
      PID:6048

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESA7EE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA7EE.tmp
Size 1KB
SHA256 cc187a6db89961f22676b20543e8cc1ff2210f64e0c27a3673c2addb81d63b16
MD5 cd5511d434373b96997f2cd79e4a9bfe
SHA1 ffd9dc45d2d42ca8090824ff6628835a4ce01cfd
SHA512 85ad9c4cd27388bf72116db124a65c5a6d8c9c3bdd2dd3ac6608066e1bd245eff8e2efc49e36159c4b83d3a9bdb9f34ee4d33becaac62e1b1110c3d0c439df0c
TLSH
T17E218C0993E8870FF0735B31BAF6172F9274FD64AFB1A75A8540022C2C51644EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

kzrq2okd.dll

Path C:\Users\Admin\AppData\Local\Temp\kzrq2okd\kzrq2okd.dll
Size 5KB
SHA256 2ef9ed1fbfd408db82540d21967dda397d739232484fe163e21382f564c7a6f7
MD5 16bedd556bde72aec37174e859982f80
SHA1 7db09976e41429b2e7fa78ddf37c486d0ff8cca6
SHA512 07c689f4987cbc7bc20c42f64ba54dbf9f6bbcd8fb24218087b612cb914fa08149521b32e03f5dfada39b176f4d679cfc6a223190be164fcbcaf6567c85de84e
SSDEEP 48:63Q+1lQYtA/gnJjjMxmcdBFGg4z6gWWKzB2wERmmIfib1gbmgDngdJupjBXoG1uJ:YIY1nJjgFiKzB8Kr/XEuK
TLSH
T199B1611A979C5693E4AB033DBCB30B06E7B5E4944B77876F09D4412A2C67F6019617A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfg_102265_d729.vbs

Path C:\Users\Admin\AppData\Local\Temp\tc0sa1hd\cfg_102265_d729.vbs
Size 228B
SHA256 bf542e7cc7d9dccc229789d0e5281388dddd8d8a673fa9472aaa06f69599ea4f
MD5 42e3bec7572eb27483b490c1ce561b96
SHA1 210a7da3ca2522773856a7fb2c78338dfc2c75a1
SHA512 4996d63b194dedce955448f78bb56afa7ba8d668f214f7f55a4e4f9ff691fd030a8c3ea787893b08b618af9aae857401965d777799ca46319b0637ee2034206d
TLSH
T17CD02300623AD24CCD39C83A0073C23CC1E3545C61001B5067D09404F98367ECF5A10D
MD5 SHA1 SHA512 TLSH

Submit Download

net_58407_d718.ps1

Path C:\Users\Admin\AppData\Local\Temp\tc0sa1hd\net_58407_d718.ps1
Size 615KB
SHA256 360bf0fe7706635e33c84002b4bef84c9109f6473a8c9eba008c87fe4ff3c431
MD5 f4b711e67a46fa52c21c0811e65d17d3
SHA1 e0467952353321d06f4c11992652bdc357e6e8cc
SHA512 66591fc7fbf7459574fe385d65f6bc13f9ae755245bbde5bfd1d43b75f697e9d2a473024e11f77d376e4abaf536e0c0ccd7b12936be8b0d08ecfbe6503f7ce4b
SSDEEP 12288:cUHLCb1Z6vXiL2ZbAQCitsjBBN6yo/Al3Pb5jLmczjy/mRyZPqvByNPq:kpoIljFLJqmmz0
TLSH
T1FCD4D022364003B3E5DDAD83ABF5770793B73812DAE76C46322DD2E11F1A1627A815ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC353F7D1841EB4338AA9B5DEF94AB2C60.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kzrq2okd\CSC353F7D1841EB4338AA9B5DEF94AB2C60.TMP
Size 652B
SHA256 7382fe2a4968e89a1b9410fa1279562aea6c46e6ba9c12c2a5a5128e1f1358d7
MD5 a419a4d1e44c9aff09f52a187bdcace9
SHA1 2c5122fe0160eb2cb6802df96b5f311e94976ce9
SHA512 144e14d7a0f6bc639dbad0e911a0350c0f9a07ca55543af81583ae8f3d6e5354aa11283147c0e29000cde44ce4b7703cec914e767ef50b698abb20e2eb71098d
TLSH
T12AF03A49A3F8520EF4F34B30B9F6436391B9BC64DE32A3ED1480031D2C646109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

kzrq2okd.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\kzrq2okd\kzrq2okd.0.cs
Size 3KB
SHA256 bc5d5fe5696ac168ad0cbd7d3348e475d27744570ed085f2ef663c88e03ce620
MD5 1533066361afbccbc91fab713679a4b9
SHA1 ccc3b26bb80aa19a055ef0623d3a5c48598dbd40
SHA512 2028332b95542f76974d7b86426f174b0d560e43ae29982f89cbae65b0e445e35e9224a2dd26911e047bb662b326648196fa63a8989345501c86450099c01bef
TLSH
T1BD61EF3C1316976258B32125FA9190CEE70310731ABF592039FD97222F7B15AE176F1E
MD5 SHA1 SHA512 TLSH

Submit Download

kzrq2okd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kzrq2okd\kzrq2okd.cmdline
Size 369B
SHA256 c6b829352948040ccec4d5fa62aaeb0a673747273d6586b4bea5b78736c0cb15
MD5 528f1f4440fbe775bf9bf76a3d43f3f9
SHA1 7e279f067dd181538ac29e21398e754e97c8e051
SHA512 a885edf77ea8bbe9ec5edadbb1d04cc8b8630b5a4f27164055622c71c700a7d1abeca687baadfb378f428ca2ce1a539342ea5e1742ff36f5ebc836fee9208836
TLSH
T182E0682A4246C27D81FD2407656AC4AC837207C339403F845449C48FD0179006FE17A9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4776-6-0x0000024632380000-0x00000246323A2000-memory.dmp

Download

memory/4776-20-0x0000024632840000-0x0000024632848000-memory.dmp

Download

memory/6048-21-0x0000000000400000-0x000000000047C000-memory.dmp

Download