lxbaserat | e9428c30d4f3e09d7f93ae3d7ee557ba697b058077e9c011274e1c4e22a8e4a1

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Copy_of_INVOICE.js
Size 1.8MB
Sample260731-d6341svyft
SHA256 e9428c30d4f3e09d7f93ae3d7ee557ba697b058077e9c011274e1c4e22a8e4a1
MD5 8de8c09326bf86d06ddfb2f14f7d6f6b
SHA1 8978729cd2155d30e521be12cb5c899288a68620
SHA512 a4c1bcb4437a7e66260763dd3fcbfb6684ebea36b57b5c2b529445df901ac34b6f7e6e3e8b772fd8d5a4a78335ae889077b99beeda20cb0d7713299bd19682b4
SSDEEP 49152:H6QbQ8zTceKFcq7dcgqqWE9HmPkI5aK0Z5OzKIjrmQSLmOKjYunkRyCv/H1dTh:HBaF5FfTSOY/MRTHTh
TLSH
T19695A01D6EC8D059CAFCE3730C9EBC27E1762223A1939993706EF67C3A40F91A741599
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 929acdbe5c7a4a94a39661fed1510af6 execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.22

Botnet

Group1

Campaign

929acdbe5c7a4a94a39661fed1510af6

lxxlxxnew.noip.at:4055

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
2QGK9FXiUvDR2Ikae0nr

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2960	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5724	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2960 set thread context of 1596	2960	powershell.exe	96

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2960	powershell.exe
2960	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 5724	4224	wscript.exe	91
PID 5724 wrote to memory of 2960	5724	wscript.exe	92
PID 2960 wrote to memory of 2460	2960	powershell.exe	94
PID 2460 wrote to memory of 3320	2460	csc.exe	95
PID 2960 wrote to memory of 1596	2960	powershell.exe	96
PID 2960 wrote to memory of 1596	2960	powershell.exe	96
PID 2960 wrote to memory of 1596	2960	powershell.exe	96
PID 2960 wrote to memory of 1596	2960	powershell.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Copy_of_INVOICE.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\e026hnvs\run_50287_90cd.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\e026hnvs\clr_31134_90ae.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nulqqq4m\nulqqq4m.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB0A9.tmp" "c:\Users\Admin\AppData\Local\Temp\nulqqq4m\CSC7C8087F7281B48C8A9FEAD4FDA25D21.TMP"
        5⤵
        
        PID:3320
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      4⤵
      PID:1596

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESB0A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB0A9.tmp
Size 1KB
SHA256 f616c50c5f46e01c47f4d436680e135f8ea8d9acd0ad3b206476c4f4e6db22ea
MD5 58bac0279eac18dc5c5f9cddb2ecf47a
SHA1 5fdbbea4ef2c177b546782fc1b86c5c62fc39ee1
SHA512 f8c090db62678a72678faab4e6dbbbcbb1d3c73d4e2f0d20e072529bcd9aebfd436e331acf45ec6e958e7cbde6b8d381ddfe4279bd5279b59df95ca761ea4331
TLSH
T15421C00593ED8B1FF0734B3179F6132F5239FE54DFA16756944042282C51104EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

clr_31134_90ae.ps1

Path C:\Users\Admin\AppData\Local\Temp\e026hnvs\clr_31134_90ae.ps1
Size 5KB
SHA256 b1c522e525deff6540986166a422ebfaeb41ef15e5278965a352cfa6d90988d3
MD5 7adda95a15726ba372eaa4f96d505124
SHA1 df395791a7a2b37046fe4dfec8145a8f92ea08c8
SHA512 d11660c2214cfc70619ce8ddc880b80bd11d6269cb311a896d2f76b7ea81af222499c7bfee28e3596d504d5e2dc8c4c8a6b56e4b309b00ac779e28a436e1c98e
SSDEEP 96:aJc2uFij/f5jPf5urXGIoBYSKhwwDzm8CgrcXqbHeV9oulDV81z8:mgij/fZPfyWIomSKh3mWrXr8bX
TLSH
T15EB18306BBDA47F9028364644AB35652B6B5E02B294F1D04F6FDC3CDBF05434D2F51AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run_50287_90cd.vbs

Path C:\Users\Admin\AppData\Local\Temp\e026hnvs\run_50287_90cd.vbs
Size 228B
SHA256 f8852cc5d0606de9690e5fce3511e8de15f2a2ad44a6c0144cdf3753149e6752
MD5 6096ce8b653f2b56977c654ddb43c89d
SHA1 74576ea8276b2847c3894fd7fe5a2fe4ca99f512
SHA512 97654b2b729b1845086c57cbcb6e4f797b6f7e5ab867f0fefbc055fbf795aa17bf2b3e1e2057600f56fcb102aedc294a84cdb18ac03f8b644c864b5ee2780335
TLSH
T1A6D0A711623BD21CDD25C5690262967C86D368982500575577909918BDC11A9CA6A149
MD5 SHA1 SHA512 TLSH

Submit Download

svc_32741_90ac

Path C:\Users\Admin\AppData\Local\Temp\e026hnvs\svc_32741_90ac
Size 805KB
SHA256 9e393439704d64ec65b735514d44a6ebefa197696af391eb7eb35937765a64d7
MD5 8e8ad196f0cc129cf9c31663933adbbc
SHA1 b0835b3bd145f83b7a1edd40be4a31c6b712ac33
SHA512 c29236c62099dc9baa1610044a2ae899309088720cea4fefe616c4598092555a79134f1e14c8cdf872ec802b82b7694252911fb0b14c970a2c1d96c0c1bb1994
SSDEEP 12288:yuJKcmA4fOOLMrVMXOyfx6zSJwJkVO7KrZ/3UDn1tBe+GbCHB0OsuHeF4z4lbCwd:yu6zEkJhxnZ/3O17VZOOsJF4s9v
TLSH
T1E70512468E368E3CD6A415E8287D1F853FE48F9184A8EBF354B660F359C393630A765C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp_65352_90ab

Path C:\Users\Admin\AppData\Local\Temp\e026hnvs\tmp_65352_90ab
Size 79KB
SHA256 070d0671f90afb260adc22ee9baa28f400fc7948d4cf5f6fba3dd47e9da15c86
MD5 d347687ef0614f45b91a294ab2e7faf8
SHA1 6ad5039f8d2f735763a34e13b2d585bcf461c0f2
SHA512 5cf8872d69edcc95c20f1ca412875d2e8eba79c37bc4e37a8886cd00a5ddf4c691cf5eb2da6425bba59ae630795becbc8ca097c97a9686d63601ab752edf0f1a
SSDEEP 1536:v8AoB4a3+xeDSodTk2BiUg6WJ7Xsjc9TyDi3Mx3P9AqCFlyp++aDmZY:vVoBp3KBodTykaKc9TCi2fqzlbpmZY
TLSH
T1FA83F285E919CF3889AC32D810FC378F17E49D48857882DA926768B3A7F3395B09D749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nulqqq4m.dll

Path C:\Users\Admin\AppData\Local\Temp\nulqqq4m\nulqqq4m.dll
Size 3KB
SHA256 068b9ba8ba8755ff3d0f3b5df4a4d75e322910a6a2b2bf85f0024325b6aac301
MD5 db4c90520a9176dc0a348843760c806c
SHA1 701105341d476b0d4c51965c59645aa29c5dc490
SHA512 fd33634b39c27501300311dd7a8db9a87eeeb0ff3cf352c6eda1c282825486a5cd0e630c02d14817498b8f69a287f25bfddb6497a63b236cf029867b3af94378
TLSH
T1D651CB1A97E88A2BF0770B31AEF3472777A9FD109BB2635E09904218AC206544E31FF0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7C8087F7281B48C8A9FEAD4FDA25D21.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nulqqq4m\CSC7C8087F7281B48C8A9FEAD4FDA25D21.TMP
Size 652B
SHA256 69c060d137c96241e26a431605d166e9e00836b9f03d713b68be38e6a579a20c
MD5 fd4f40eff500b121e6210c9b98b697f1
SHA1 bf7dc322dc3e3c394882f2c7ebc720ec25c3c718
SHA512 8a2150dc75fe317d65e7a6b74622681c93738462fab2dc240f091c4194fc03a83a2c0bd386e29a8e173efdae6362111717ffa50f0a9ff6ccc5b50dadebff176b
TLSH
T117F05E0963F8820EF1F34F31BDF6936391ADBE65DE3293ED1440031928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nulqqq4m.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nulqqq4m\nulqqq4m.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

nulqqq4m.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nulqqq4m\nulqqq4m.cmdline
Size 369B
SHA256 a2e24a2d51b94d140438f0b10364ea363b06db633d5001546b0597c7423e7d1a
MD5 3ec7c301f76c110fa245991bcf9334b6
SHA1 b0371710c335bc8750b7a29979a0b85813451163
SHA512 aaaf2568575f45886d845a680245b8716444a7df4a3ca6e3788bb50acabe4969a8d264b6a79c73dea68f729f7de584e5eb9cc3414587441a40cda77d89b22bf0
TLSH
T10DE0C63BE387C2FD11ED104B267AC4ACCA76879339C13F849070840DE1A7000AFD2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1596-27-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/2960-12-0x0000024380040000-0x0000024380052000-memory.dmp

Download

memory/2960-8-0x00000243FF850000-0x00000243FF872000-memory.dmp

Download

memory/2960-25-0x0000024380050000-0x0000024380058000-memory.dmp

Download

memory/2960-26-0x0000024380060000-0x0000024380068000-memory.dmp

Download