Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 12:57
General
- Target ΑΝΤΙΓΡΑΦΟ ΠΛΗΡΩΜΗΣ.js
- Size 802KB
- Sample260804-p68v2sxtbt
- SHA256 532af143623a2f1b55b1059f224320806556f1ad1a0c0cd8033326616d18119e
Malware Config
Extracted
-
lxbaserat
-
1.0.24
-
Group1
-
1a83f37a318549ff9e552cad18eceb6d
-
64.89.160.127:4561
-
directory
WindowsTelemetry\Logs
-
executable
client.exe
-
password
hCeWS8Uz8SJ6ASPT2fef
Signatures
- Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\ΑΝΤΙΓΡΑΦΟ ΠΛΗΡΩΜΗΣ.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\xo7gv92k\cfg_89154_2675.vbs"2⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\xo7gv92k\clr_66883_2617.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lqf3z04m\lqf3z04m.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA45.tmp" "c:\Users\Admin\AppData\Local\Temp\lqf3z04m\CSC16DB6631A5E645DB8EF9D66B948A8CC.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
- Loads dropped DLL
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\msvc_b2009c6c.exe" "C:\Users\Admin\AppData\Local\Temp\msvc_b2009c6c.cs"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCB1B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA2633D8525A64B01B6AEB91CFE4F0B6.TMP"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\msvc_b2009c6c.exe"C:\Users\Admin\AppData\Local\Temp\msvc_b2009c6c.exe" 2816 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\chrome.nacl.50353_1D10"5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Visual Basic
1Replay Monitor
Loading Replay Monitor...
Downloads
msasn1.dll
RESAA45.tmp
RESCB1B.tmp
__PSScriptPolicyTest_bwbzr5ey.c2s.ps1
lqf3z04m.dll
msvc_b2009c6c.exe
cfg_89154_2675.vbs
clr_66883_2617.ps1
svc_71865_2608
tmp_12842_2617
CSCA2633D8525A64B01B6AEB91CFE4F0B6.TMP
CSC16DB6631A5E645DB8EF9D66B948A8CC.TMP
lqf3z04m.0.cs
lqf3z04m.cmdline
msvc_b2009c6c.cs
memory/1748-68-0x0000000000160000-0x0000000000166000-memory.dmp
memory/3160-50-0x0000000007210000-0x00000000072A2000-memory.dmp
memory/3160-42-0x0000000000400000-0x0000000000484000-memory.dmp
memory/3160-56-0x0000000008AF0000-0x000000000901C000-memory.dmp
memory/3160-55-0x00000000083F0000-0x00000000085B2000-memory.dmp
memory/3160-54-0x00000000081D0000-0x0000000008220000-memory.dmp
memory/3160-51-0x00000000074C0000-0x00000000074CA000-memory.dmp
memory/3160-43-0x0000000005AE0000-0x0000000006084000-memory.dmp
memory/5032-20-0x0000000005EB0000-0x0000000005ECE000-memory.dmp
memory/5032-25-0x0000000007690000-0x0000000007D0A000-memory.dmp
memory/5032-46-0x0000000007270000-0x0000000007306000-memory.dmp
memory/5032-47-0x0000000006F70000-0x0000000006F92000-memory.dmp
memory/5032-27-0x0000000006EB0000-0x0000000006ECA000-memory.dmp
memory/5032-40-0x0000000006ED0000-0x0000000006ED8000-memory.dmp
memory/5032-21-0x0000000005EF0000-0x0000000005F3C000-memory.dmp
memory/5032-41-0x0000000006EE0000-0x0000000006EE8000-memory.dmp
memory/5032-26-0x0000000006470000-0x000000000648A000-memory.dmp
memory/5032-19-0x00000000058D0000-0x0000000005C24000-memory.dmp
memory/5032-11-0x0000000005720000-0x0000000005786000-memory.dmp
memory/5032-10-0x0000000004FB0000-0x0000000005016000-memory.dmp
memory/5032-9-0x0000000004F10000-0x0000000004F32000-memory.dmp
memory/5032-8-0x0000000005040000-0x0000000005668000-memory.dmp
memory/5032-7-0x0000000002590000-0x00000000025C6000-memory.dmp