lxbaserat | 4e8ffa1c2a250b805d1d2057b41e71d3a9c63ceb2e62417e5a376352adc9d517

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ĐẶT HÀNG _GIÁ MỚI_.js
Size 1.3MB
Sample260804-k3kxlabp71
SHA256 4e8ffa1c2a250b805d1d2057b41e71d3a9c63ceb2e62417e5a376352adc9d517
MD5 89894a49cd30900c35912e4bbd091bb1
SHA1 879e4c3dfe63dfb6dba2002cda6455f696bd3724
SHA512 10e500dbd80b70bc964f0059520b18783b0815dc839f8e88690973c5cebdb104fbc3d908ee56fa56321c50c511fe1d76d4d83cb9fec88a25db3d4b33266e0fd4
SSDEEP 24576:Hg6N3P4Qef7sEFAUlCqF0qo5x4Hv4vUsdI9JTc7RwueIJaKgBPxJreBsx:HrJNeTzASCqyxivWeB
TLSH
T161558D8123D515B5C094FB23221F7BC87B36B1D23FD7B2192490EE843A67962FD12A67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 0e88bdb59f4f4644a31d22e3c4d7da63 execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.23

Botnet

Group1

Campaign

0e88bdb59f4f4644a31d22e3c4d7da63

64.89.160.127:4561

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
gD8CElQ0FbWVKouR1UG0

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1968	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1616	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 3344	1968	powershell.exe	96

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1968	powershell.exe
1968	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1616	1324	wscript.exe	91
PID 1616 wrote to memory of 1968	1616	wscript.exe	92
PID 1968 wrote to memory of 3404	1968	powershell.exe	94
PID 3404 wrote to memory of 3244	3404	csc.exe	95
PID 1968 wrote to memory of 3344	1968	powershell.exe	96
PID 1968 wrote to memory of 3344	1968	powershell.exe	96
PID 1968 wrote to memory of 3344	1968	powershell.exe	96
PID 1968 wrote to memory of 3344	1968	powershell.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\ĐẶT HÀNG _GIÁ MỚI_.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\kfdqkw5k\net_30625_8934.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\kfdqkw5k\run_41762_8926.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\50sson1d\50sson1d.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD75B.tmp" "c:\Users\Admin\AppData\Local\Temp\50sson1d\CSC87B8FB88DC64795A8F1E68B5926AE56.TMP"
        5⤵
        
        PID:3244
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
      4⤵
      PID:3344

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

50sson1d.dll

Path C:\Users\Admin\AppData\Local\Temp\50sson1d\50sson1d.dll
Size 5KB
SHA256 edfa1c9d688be9c93a1b52e0a68b320f5afea3a1b44bf552470cd65977c575b2
MD5 4db9e39a4e22753d53973caa77b1a95b
SHA1 5512bb9cd3d778f579159b2f026b65a730ccc3b4
SHA512 be364d1b7ffffb71bea189ca449131b6e4f233a10b4d2a3b9cfd086521b1f8b45d3cb78da0ff47ad294b26e46eff0f244988ea2561a441cb06edde88d00b0fbf
SSDEEP 48:6AQ+1lQYtA/gnJjjMxmcdBFGg4z6gWWKzB2boRmmIfib1gbmgDngdJxIUpjBboGK:fIY1nJjgFiKzB+oKr41bERK
TLSH
T18CB1721697DC56A3E4BB033CBDB30B06E7B5E4940B27C76F49D4412A2CA7F641961BB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESD75B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD75B.tmp
Size 1KB
SHA256 e117e8049ac94ee82910176ff56770661b99871ee8cd091bb73b925a5eac59a1
MD5 1c0018752a028152153b4f06463ada07
SHA1 5922a5d8594a828e4170904568d5a5a0f69eb703
SHA512 bc9aaa0a3dafbdd5bbef7a83914f65f0022ed33e9c1be5af6b761823088cf9c12ef3c35cd650273302450bde337d28e2bad6e9f35aa170f2961aaf63b6702e5e
TLSH
T1BF21890993E8470EF0774B3179FA172F9274FDA4EFA2A35A854142292C91604EEF0B72
MD5 SHA1 SHA512 TLSH

Submit Download

net_30625_8934.vbs

Path C:\Users\Admin\AppData\Local\Temp\kfdqkw5k\net_30625_8934.vbs
Size 228B
SHA256 7cedee290330a1d904ecc7c7799cbabad8092a78b25ef23182aaf88bf151c7d5
MD5 9fc759bdfe5c0a1def1a83f823ed6729
SHA1 d8de77b232caee11402b77501f7d515368d9c827
SHA512 f7bafa54e39720b2070dc2a4ba5ab6139a0735385ea5d3ec1c89d5dc39b635de836dd013857b1b1a3d7ac58081f5f57433df62bb586d58faac52386b6cfa2625
TLSH
T121D0A711A23AE21CCD26C5764562823CC9E7945C75005B5167609D08B9C51A9CAA9659
MD5 SHA1 SHA512 TLSH

Submit Download

run_41762_8926.ps1

Path C:\Users\Admin\AppData\Local\Temp\kfdqkw5k\run_41762_8926.ps1
Size 620KB
SHA256 0ec45e95453a29158ef905bfb740508bb3732251f201ea76fd592d0c2de90394
MD5 4796b0fa77af5e6d72b2f1e37acdf460
SHA1 a16a4e72ec3c1738c9e5bd7a69b17e386a9d2d48
SHA512 858af1464eb713cb586efaf2f86780eacf8bacec20f366e8e86dc69dc3f80c6d720095956297fa1357a5d7978595369c3f0fac2745b7a7995da191fd8ac4d1f5
SSDEEP 12288:cQPwBTvJmF6a77DcZsbv1P/jCi7d7VD+gxUw7C1Zl9PHfj+:L4ZK9GgrQ3vC
TLSH
T152D4CF2136404333E6DDAD8397B4B64793B73523DAE76C0B333DE1D52F16127AA809A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50sson1d.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\50sson1d\50sson1d.0.cs
Size 3KB
SHA256 bc5d5fe5696ac168ad0cbd7d3348e475d27744570ed085f2ef663c88e03ce620
MD5 1533066361afbccbc91fab713679a4b9
SHA1 ccc3b26bb80aa19a055ef0623d3a5c48598dbd40
SHA512 2028332b95542f76974d7b86426f174b0d560e43ae29982f89cbae65b0e445e35e9224a2dd26911e047bb662b326648196fa63a8989345501c86450099c01bef
TLSH
T1BD61EF3C1316976258B32125FA9190CEE70310731ABF592039FD97222F7B15AE176F1E
MD5 SHA1 SHA512 TLSH

Submit Download

50sson1d.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\50sson1d\50sson1d.cmdline
Size 369B
SHA256 b739c6d3eb5a524e48695c77bdb9d2f5ae8400572da18fc1fe775bfc47c4b27f
MD5 e5880a17b583aece1537d8776626e49b
SHA1 fc1321225c57e7c6c17c5abea9b2b6caf55318d4
SHA512 1a1482cd06472d8b13ac39da6975f991a127dbe077192a55cab5f9d3bd5fe867415013f95ce22c5723a972e38d9b70b65ea6d2997078711f266f5e807d48b2e8
TLSH
T128E0683E6246C27D05DDD0076179C9ACC27246C32A403FB45240880ED05740227D2761
MD5 SHA1 SHA512 TLSH

Submit Download

CSC87B8FB88DC64795A8F1E68B5926AE56.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\50sson1d\CSC87B8FB88DC64795A8F1E68B5926AE56.TMP
Size 652B
SHA256 0b18994a74a3e10b2342e12fadc78516e88ed01fee3e3e57fe21d91a46f4f40b
MD5 fc341576e728b98c36c9294e8037fc5d
SHA1 0eb070312c189cde42936602784e8dca75c3eba0
SHA512 197fb3c72e6f4d5cedcd3386685d9e6822d6ca534298b9d82fe25af2496fe51d59ef03434ec59f2eceba60ac022f006ee4825ef78c4b81e9045ec1cc7f8c0f8b
TLSH
T124F03A0963F8520AF0F34B30BEF6436395A8FC64DE3293ED144103292C64610C972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1968-6-0x00000230F85C0000-0x00000230F85E2000-memory.dmp

Download

memory/1968-20-0x00000230E0470000-0x00000230E0478000-memory.dmp

Download

memory/3344-21-0x0000000000400000-0x000000000047E000-memory.dmp

Download