lxbaserat | e9428c30d4f3e09d7f93ae3d7ee557ba697b058077e9c011274e1c4e22a8e4a1

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HSBC Swift Payment.js
Size 1.8MB
Sample260731-efet6stcra
SHA256 e9428c30d4f3e09d7f93ae3d7ee557ba697b058077e9c011274e1c4e22a8e4a1
MD5 8de8c09326bf86d06ddfb2f14f7d6f6b
SHA1 8978729cd2155d30e521be12cb5c899288a68620
SHA512 a4c1bcb4437a7e66260763dd3fcbfb6684ebea36b57b5c2b529445df901ac34b6f7e6e3e8b772fd8d5a4a78335ae889077b99beeda20cb0d7713299bd19682b4
SSDEEP 49152:H6QbQ8zTceKFcq7dcgqqWE9HmPkI5aK0Z5OzKIjrmQSLmOKjYunkRyCv/H1dTh:HBaF5FfTSOY/MRTHTh
TLSH
T19695A01D6EC8D059CAFCE3730C9EBC27E1762223A1939993706EF67C3A40F91A741599
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 929acdbe5c7a4a94a39661fed1510af6 execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.22

Botnet

Group1

Campaign

929acdbe5c7a4a94a39661fed1510af6

lxxlxxnew.noip.at:4055

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
2QGK9FXiUvDR2Ikae0nr

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1484	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4104	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1484 set thread context of 3348	1484	powershell.exe	96

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1484	powershell.exe
1484	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1484	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 4104	2692	wscript.exe	91
PID 4104 wrote to memory of 1484	4104	wscript.exe	92
PID 1484 wrote to memory of 3896	1484	powershell.exe	94
PID 3896 wrote to memory of 3408	3896	csc.exe	95
PID 1484 wrote to memory of 3348	1484	powershell.exe	96
PID 1484 wrote to memory of 3348	1484	powershell.exe	96
PID 1484 wrote to memory of 3348	1484	powershell.exe	96
PID 1484 wrote to memory of 3348	1484	powershell.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\HSBC Swift Payment.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\98ivlzbb\svc_68655_d004.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\98ivlzbb\run_53570_cfe2.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xlulsjaj\xlulsjaj.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6AC6.tmp" "c:\Users\Admin\AppData\Local\Temp\xlulsjaj\CSCF889D4A0FD2F43B093480E5DF3CA611.TMP"
        5⤵
        
        PID:3408
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      4⤵
      PID:3348

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dat_24576_cfdc

Path C:\Users\Admin\AppData\Local\Temp\98ivlzbb\dat_24576_cfdc
Size 79KB
SHA256 070d0671f90afb260adc22ee9baa28f400fc7948d4cf5f6fba3dd47e9da15c86
MD5 d347687ef0614f45b91a294ab2e7faf8
SHA1 6ad5039f8d2f735763a34e13b2d585bcf461c0f2
SHA512 5cf8872d69edcc95c20f1ca412875d2e8eba79c37bc4e37a8886cd00a5ddf4c691cf5eb2da6425bba59ae630795becbc8ca097c97a9686d63601ab752edf0f1a
SSDEEP 1536:v8AoB4a3+xeDSodTk2BiUg6WJ7Xsjc9TyDi3Mx3P9AqCFlyp++aDmZY:vVoBp3KBodTykaKc9TCi2fqzlbpmZY
TLSH
T1FA83F285E919CF3889AC32D810FC378F17E49D48857882DA926768B3A7F3395B09D749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run_53570_cfe2.ps1

Path C:\Users\Admin\AppData\Local\Temp\98ivlzbb\run_53570_cfe2.ps1
Size 5KB
SHA256 165eb8cf550580dd4f2d3b1c85a579cd78d566420835a3da8b3687b7bddc8aba
MD5 e41d0141a5410fad1a49a1998fb7f870
SHA1 e22a40d7a672b097aef36fee47d749524cfce614
SHA512 81da503193482a2f9a1c32f65f6468314c373c38eaabbd98f2b211cf90edf3e45342d58e75a8d1986c09ac91bc3a312f5adb40315afffae7bbaa9bfd78f5e750
SSDEEP 96:aJc2uFij/f58Pf5k8rXGIoBYSKhwwDzm8CgrcXqbHeV9oulDV80kd9:mgij/fGPfCaWIomSKh3mWrXr8bkf
TLSH
T105B19306BBDA43F9028360644AB35656B6B5D12B294F1D04F6FDC3CDBF05834D2F51AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_49706_cfdf

Path C:\Users\Admin\AppData\Local\Temp\98ivlzbb\svc_49706_cfdf
Size 805KB
SHA256 9e393439704d64ec65b735514d44a6ebefa197696af391eb7eb35937765a64d7
MD5 8e8ad196f0cc129cf9c31663933adbbc
SHA1 b0835b3bd145f83b7a1edd40be4a31c6b712ac33
SHA512 c29236c62099dc9baa1610044a2ae899309088720cea4fefe616c4598092555a79134f1e14c8cdf872ec802b82b7694252911fb0b14c970a2c1d96c0c1bb1994
SSDEEP 12288:yuJKcmA4fOOLMrVMXOyfx6zSJwJkVO7KrZ/3UDn1tBe+GbCHB0OsuHeF4z4lbCwd:yu6zEkJhxnZ/3O17VZOOsJF4s9v
TLSH
T1E70512468E368E3CD6A415E8287D1F853FE48F9184A8EBF354B660F359C393630A765C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_68655_d004.vbs

Path C:\Users\Admin\AppData\Local\Temp\98ivlzbb\svc_68655_d004.vbs
Size 228B
SHA256 d2d3d0939ab6ad87490214e954e99cf6b8d703d5d95f3f3355fd45dfe81f4f77
MD5 9a2bcd851c6846cf1c3709b8537d4836
SHA1 7e3688a5cc85cb85e71b2eff35cb428a60d815d8
SHA512 db08bdfbdf8504ae14ba62dfd2e9e310a390850222eaacd548cca361d6f9585391c8788bc9d9604fb87b65ce052e77f1d3ffc24292effae91393cf4373692298
TLSH
T149D0A7207239E21CCD25C4750167C26C89A359986100575167609524B9D15A9CE59549
MD5 SHA1 SHA512 TLSH

Submit Download

RES6AC6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6AC6.tmp
Size 1KB
SHA256 3d1c317fdf3af814ed8b5d9a16ffde85e95cebd6fd5c84ae237649a9b8d106f1
MD5 98f7d20a0a6f80f64a71405e62d6d445
SHA1 b62697647682c24efe2faf5a21d1c79ed1183c39
SHA512 ed7ad8e3d5d60565a1eb55d08317c6ef5265eabb60ad4b2ccc28cd9888d7709bd9fba5cecd21716fe82716b23964cb0735b84e230a69dc06a6f04a036e5d4fb5
TLSH
T17721EF0493E9471FF07387317DF6532FA274FD64EFA2639A954442182C41104EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

xlulsjaj.dll

Path C:\Users\Admin\AppData\Local\Temp\xlulsjaj\xlulsjaj.dll
Size 3KB
SHA256 7dc8d6383dd7a0f968235ae14f41252c5c235366c1b9b0bb937856b0a7bd7be0
MD5 e1ce6951d2556d1c1cb908b76099bcf0
SHA1 e3f796e0aa67857a3000d4a90c0c170035723665
SHA512 fbb4081a59e48f4ab0a1f9c9ac80d07781804316e95b94ddaf96e99121ab80ce69d9762cebb0479de92057c92d2a87976eaf56c79df5585763a619c0ab955cef
TLSH
T1F851CD065BE9862BE4730B306DF3431677B4FC109BB2575E19904218AC616684E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF889D4A0FD2F43B093480E5DF3CA611.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xlulsjaj\CSCF889D4A0FD2F43B093480E5DF3CA611.TMP
Size 652B
SHA256 1c5ee7ced65c4ba730da2fc818089ac3c02e2f7222b2a8769f127415c939ea65
MD5 8cb711e6cc89456a3df5be363a16ae42
SHA1 0ee48bb9f2056928b7be568af2c5fc3efa371554
SHA512 8f1463e33f8ef956a953072c895812c1d4d9dd95fad7a694f9908680457bf0a89f626bc11d9363e85787fe655b509257c682b2d83c8321f6df86e79fba21fec8
TLSH
T1F8F05E0963F9020EF0F34B30BDF683A391A9BC65DE7293ED245043192864624C972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xlulsjaj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xlulsjaj\xlulsjaj.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

xlulsjaj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xlulsjaj\xlulsjaj.cmdline
Size 369B
SHA256 46f0e164e8ad67cc31d8137b0af49982dd4acf94bdf54fea871b0ffcdddb4d66
MD5 8c21e920e838a3503e278cc8c8827190
SHA1 85c87c86a63bf65af00cc612e1dc52b328012e14
SHA512 dbe2b5d4aecb215f92d3db87ec989356a988983ef21a195bea273b955a18c65efa6fad208761c336bd876806d26495f5a2e5ccb133f4477f22e3d17ee20b58d8
TLSH
T128E0C02B77CAC37D01DF5007216DE4ACC373574329403F886184488FD01704D6BD1749
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1484-12-0x0000017DF3440000-0x0000017DF3452000-memory.dmp

Download

memory/1484-6-0x0000017DF3910000-0x0000017DF3932000-memory.dmp

Download

memory/1484-26-0x0000017DF3AC0000-0x0000017DF3AC8000-memory.dmp

Download

memory/1484-27-0x0000017DF3AD0000-0x0000017DF3AD8000-memory.dmp

Download

memory/3348-28-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/3896-24-0x000001E0264F0000-0x000001E026E94000-memory.dmp

Download