Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 12:57
General
- Target ΑΝΤΙΓΡΑΦΟ ΠΛΗΡΩΜΗΣ.js
- Size 802KB
- Sample260804-p68v2sxtbt
- SHA256 532af143623a2f1b55b1059f224320806556f1ad1a0c0cd8033326616d18119e
Malware Config
Extracted
-
lxbaserat
-
1.0.24
-
Group1
-
1a83f37a318549ff9e552cad18eceb6d
-
64.89.160.127:4561
-
directory
WindowsTelemetry\Logs
-
executable
client.exe
-
password
hCeWS8Uz8SJ6ASPT2fef
Signatures
- Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\ΑΝΤΙΓΡΑΦΟ ΠΛΗΡΩΜΗΣ.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\ls5pd7y2\clr_54947_1577.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ls5pd7y2\clr_40853_1550.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ypd2usds\ypd2usds.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A7F.tmp" "c:\Users\Admin\AppData\Local\Temp\ypd2usds\CSC21CD3019658B448DBE44F18C18A6AB72.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
- Loads dropped DLL
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\msvc_7e15864c.exe" "C:\Users\Admin\AppData\Local\Temp\msvc_7e15864c.cs"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES645D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC49EF601ED44C4C31A7B586B9B66F84D.TMP"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\msvc_7e15864c.exe"C:\Users\Admin\AppData\Local\Temp\msvc_7e15864c.exe" 1556 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\chrome.sync.29674.7637.FB8C"5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Visual Basic
1Replay Monitor
Loading Replay Monitor...
Downloads
msasn1.dll
RES3A7F.tmp
RES645D.tmp
clr_40853_1550.ps1
clr_54947_1577.vbs
net_24424_1550
tmp_93317_154f
msvc_7e15864c.exe
ypd2usds.dll
CSC49EF601ED44C4C31A7B586B9B66F84D.TMP
msvc_7e15864c.cs
CSC21CD3019658B448DBE44F18C18A6AB72.TMP
ypd2usds.0.cs
ypd2usds.cmdline
memory/2684-34-0x0000000007880000-0x0000000007888000-memory.dmp
memory/2684-39-0x0000000007900000-0x0000000007922000-memory.dmp
memory/2684-35-0x0000000005450000-0x0000000005458000-memory.dmp
memory/2684-19-0x0000000007C70000-0x00000000082EC000-memory.dmp
memory/2684-8-0x0000000005850000-0x0000000005872000-memory.dmp
memory/2684-9-0x00000000058F0000-0x0000000005956000-memory.dmp
memory/2684-15-0x0000000006690000-0x00000000066DC000-memory.dmp
memory/2684-20-0x0000000006C10000-0x0000000006C2A000-memory.dmp
memory/2684-6-0x0000000002DC0000-0x0000000002DF6000-memory.dmp
memory/2684-10-0x0000000005960000-0x00000000059C6000-memory.dmp
memory/2684-38-0x0000000007980000-0x0000000007A16000-memory.dmp
memory/2684-21-0x0000000007850000-0x000000000786A000-memory.dmp
memory/2684-7-0x0000000005A60000-0x00000000060AA000-memory.dmp
memory/2684-13-0x00000000060F0000-0x000000000644B000-memory.dmp
memory/2684-14-0x0000000006630000-0x000000000664E000-memory.dmp
memory/4436-60-0x00000000002A0000-0x00000000002A6000-memory.dmp
memory/4840-48-0x0000000008B30000-0x0000000008CF2000-memory.dmp
memory/4840-49-0x0000000009230000-0x000000000975C000-memory.dmp
memory/4840-47-0x0000000008910000-0x0000000008960000-memory.dmp
memory/4840-44-0x0000000007030000-0x000000000703A000-memory.dmp
memory/4840-43-0x0000000007040000-0x00000000070D2000-memory.dmp
memory/4840-37-0x0000000005A70000-0x000000000602A000-memory.dmp
memory/4840-36-0x0000000000400000-0x0000000000484000-memory.dmp