lxbaserat | 80887401052b82fb43520fc96acf3ff5c8ac94ca43d44b683ba6622eaa6e7dce

Analysis

max time kernel
298s
max time network
303s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Revised Contract for Review.js
Size 1.8MB
Sample260730-e69ggabg69
SHA256 80887401052b82fb43520fc96acf3ff5c8ac94ca43d44b683ba6622eaa6e7dce
MD5 584dded2a13662f4ccc1f92bc6623259
SHA1 fa16efad4f5027c45826112d52ae43bdeb293416
SHA512 47569c45abce9140e0ea89d8199dd62f7d73b70c7fa1685ad24bb3cdec99756b392a2cd32619a5655989312ca17d1929f136ff8d6cc266c58869d3ae6cc7dbe4
SSDEEP 24576:nrE+EIB3wZi505I7Yo7X0Cy09l60RWbznU:nrkXi50Kao608bzU
TLSH
T1F6958DC9479918B07870CD56A2385F88C7AB737B66344C6F6538750B1EB3A0EB942CB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

groupwednesday 69f0c6800f8641d3bd5082eb90c840fe execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.22

Botnet

GroupWednesday

Campaign

69f0c6800f8641d3bd5082eb90c840fe

purchaseorder.ydns.eu:4525

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
cYohqdPIFGdLyCntwdIH

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2156	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4240	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2156 set thread context of 5140	2156	powershell.exe	95

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2156	powershell.exe
2156	powershell.exe
2156	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 4240	4452	wscript.exe	90
PID 4240 wrote to memory of 2156	4240	wscript.exe	91
PID 2156 wrote to memory of 2440	2156	powershell.exe	93
PID 2440 wrote to memory of 5364	2440	csc.exe	94
PID 2156 wrote to memory of 5140	2156	powershell.exe	95
PID 2156 wrote to memory of 5140	2156	powershell.exe	95
PID 2156 wrote to memory of 5140	2156	powershell.exe	95
PID 2156 wrote to memory of 5140	2156	powershell.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Revised Contract for Review.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\b167sxj7\clr_34234_a9a1.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\b167sxj7\dat_66625_a986.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hqeh5gqn\hqeh5gqn.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2440
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE872.tmp" "c:\Users\Admin\AppData\Local\Temp\hqeh5gqn\CSC30CBD2AF6ADF4F0FAC9DF7FA6C8FC50.TMP"
        5⤵
        
        PID:5364
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      4⤵
      PID:5140

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESE872.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE872.tmp
Size 1KB
SHA256 d9013f8079f4da8fa44f1812ea37df1260f4093a79df26e3ab8cf6e96ef9c8b4
MD5 a86b666a0a24d001c8e5fecf6ac9784a
SHA1 26affaa7f9c23176a9609b1fcaeb2260c1601822
SHA512 dc561e6a9e010dbdcb54b76eebac81324eb5d84bf9f1b13053245d25ac5ddfdea41c8188fecb66039cd25ffec610e62dcc8cd66e8fbeda29f2e733827f7d45c2
TLSH
T165218C0593E8870EF0734B3169F6272F9274FD95EFA5535A954542282851104EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

clr_34234_a9a1.vbs

Path C:\Users\Admin\AppData\Local\Temp\b167sxj7\clr_34234_a9a1.vbs
Size 228B
SHA256 a10b5d61438785ad362bfdf043901ce1cec27e6e259144323f53587a6176fa68
MD5 d7e95a46afad2c15e8f19fb2c844405d
SHA1 7f81016be233411e6d7fdcf60fc038cb4d4d64c2
SHA512 6faeaad53ba7d3fcb8e7f5132746bcc8216e90be9bb174aa194a7332529f086c003cc93cd3bb87a1a62b70ce6c482244664bb600a365edfe7ffa66099e4cd09d
TLSH
T147D023207239E31CCC34C53500B2C33C80D3685C2200573127509A4CFAC1278CE5A109
MD5 SHA1 SHA512 TLSH

Submit Download

dat_66625_a986.ps1

Path C:\Users\Admin\AppData\Local\Temp\b167sxj7\dat_66625_a986.ps1
Size 5KB
SHA256 cde8223133e911bac56819c1385d6e29871ff410be90f8fe3733cef6a7cc4601
MD5 03c0dc0424af6c951f8e1299842be637
SHA1 b7b8e5520392168195d4db8b7b5280744703028f
SHA512 12ce8594de4fac0e364a5de92e0af1e2f54ceeee69bb8dda232b562588c64357ea9b9e6fe39bf16074c28c6fa97c91700f179e07b17bf7af17efd90c9fcfafd2
SSDEEP 96:aJc2uFij/f5Hf5LdRISGIoBYSKhwwDzm8CgrcXqbHeV9oulDV87Gu:mgij/fRfRdRI3IomSKh3mWrXr8bo
TLSH
T190B19506BBEA47F902C3546409B25A62B679D42B254F1C04F6FDC3CDBF4A474D2F50AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_65631_a984

Path C:\Users\Admin\AppData\Local\Temp\b167sxj7\log_65631_a984
Size 804KB
SHA256 02a4e53e37489e017b7fab743622131e7d1fa5cf3aa349a73c8c83de49f89f67
MD5 b253d462224d55a844c8dc37dd753b1b
SHA1 10f5c63c375d331ea6396940f2d408adde4cddc2
SHA512 f3994b976c17f6d105b092efc88afc988e9b68f68cc66526a508f0a937a72f56b0796305853cc385293f0393aa6b925d414a496c37f70cac51d3318458f51de8
SSDEEP 12288:M3tJZLdvDqnFIUb5Rc8Qpdvzlue3tlaJEH3tNwztVNhJN3mqvuaVayRV3EEck2rj:u1pvwb5Rc/XZuwtla2cZlP5rVaw0tku
TLSH
T1A8051209893A8D68C1E8199C3C770FCC2BF46A8040DCEBE795BE64B215D776F30A7665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_69344_a984

Path C:\Users\Admin\AppData\Local\Temp\b167sxj7\svc_69344_a984
Size 79KB
SHA256 75e59cbccb405bf1f1bf8de32310c2e6027b3650113e666da2258f2702a8e09c
MD5 d37c7098df84d9f4aebb8612333dd85d
SHA1 8f7d11d230bab0d1877cee60544773029196b322
SHA512 644b5f24596603d730d8cbdae64bd2a89855437917b756736fd8cb196a264d8ec8c0a5a34259ba51e7c11327c6bc2c85b3adbf7b101ed0f7574a84bbc808de94
SSDEEP 1536:D2D/nELsJnwDxV5vBlFIokOxwsXRCASwakSoPuxN9IsN5B2gumSJm:D2DfELs9wDXtBlFIokO+sBzha0ON9lB1
TLSH
T18683024A412BD95EE5AC1B8754BF2BCF6AB008989474B387613F705AEF9335E30BC158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hqeh5gqn.dll

Path C:\Users\Admin\AppData\Local\Temp\hqeh5gqn\hqeh5gqn.dll
Size 3KB
SHA256 ab202550b83cca012662c256a9d5bb7aca47a4720eb224f33976ad1656befa86
MD5 4a7ada463a5f477ce7f96b4446dcd72f
SHA1 cc14bc54c52032fd2ced0a68426fbeef5959ce70
SHA512 ecff97a8d6dede21ac6bc5b2797631004064d3e093f4f566f1cbcb4680d7201c888232e6783f0a8ab0b97873dc9739acc539e056c6c753b8cee92711b69890a8
TLSH
T1C251DD1B57E8862BF4730B30AEF3472777A4FC509BB2635E1D904268AC217645A31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC30CBD2AF6ADF4F0FAC9DF7FA6C8FC50.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\hqeh5gqn\CSC30CBD2AF6ADF4F0FAC9DF7FA6C8FC50.TMP
Size 652B
SHA256 06984a02fa593254a0c1fd9f33e91f113cb0508b814ca77d50b8827280ded2ac
MD5 00baf28a3209a72c30a174648c0b9fe9
SHA1 3b9a79b19595c8efca9af39f212f203c439e7859
SHA512 f514abde1ac4c1ab332cf9d532e4445351fbf79dbfbaf6502bb3e7aef7594e9461c00f13536147ae812e85b69af423005070d131c1d659a48ebfaaa12e8dcf35
TLSH
T1E5F05E0963F8420EF1F34F30BDF6536391A8FDA4DE7293ED2455432928646109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

hqeh5gqn.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\hqeh5gqn\hqeh5gqn.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

hqeh5gqn.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\hqeh5gqn\hqeh5gqn.cmdline
Size 369B
SHA256 ea7c8017771b5267d5cd62b328efce481dbe62486febfa9e9f96d31be34149e1
MD5 dd1633a24a1460cff11bf53d6636c9f0
SHA1 26aecf7206cef7876a39373180ffcfbd981daf70
SHA512 fb5d393ec7115fe741c73d0282d2f4cf3c4b676b9314983c6539bd23ed4963ded4a24a83ac92a3609136c378f7b3dc865e2b6ce75a02925600d06856efad27cf
TLSH
T185E0C03A4246C27D25DD110726B9D4ACC272074339483FC47150448FD01711037D1747
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2156-12-0x000002414F060000-0x000002414F072000-memory.dmp

Download

memory/2156-8-0x000002414F010000-0x000002414F032000-memory.dmp

Download

memory/2156-25-0x000002414F070000-0x000002414F078000-memory.dmp

Download

memory/2156-26-0x000002414F080000-0x000002414F088000-memory.dmp

Download

memory/5140-27-0x0000000000400000-0x000000000047C000-memory.dmp

Download