lxbaserat | ce5342598b6c99985bab9146bdfb5932a3846b7db2b279c9707bcdb48dd94a63

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO NO.4500101696.js
Size 812KB
Sample260810-egva9adh84
SHA256 ce5342598b6c99985bab9146bdfb5932a3846b7db2b279c9707bcdb48dd94a63
MD5 d070d2b8dca78ee8f2d3af8ef08a41a6
SHA1 1a9aa13732ed1236d29841420191a569d29b2d76
SHA512 857dae4d32224f6b340f6e821681a9221e773eef34f5a56aa84ce9cd4d05a323cef29e13bd74e699ef2045817b9488889793f044b8622012d7a27b7a39a055f0
SSDEEP 24576:feoHfWsz7FAOmbDN7V1usnZVbkWM2nhNII/B/KNS5Mo:G212uGvkWTnw8
TLSH
T193056D56B3A3935F3016D6A6895A403089FFDF16A372C1A0DFC38D7EB4BCBA8C514958
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aug-10 1e67cc3f395449b682937f6205b35352 execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.27

Botnet

AUG-10

Campaign

1e67cc3f395449b682937f6205b35352

purchaseorder.ydns.eu:4525

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
heJ0CIHGPbCoQrxqv0J9

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3860	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4336	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3860 set thread context of 360	3860	powershell.exe	96

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3860	powershell.exe
3860	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3860	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 4336	3388	wscript.exe	91
PID 4336 wrote to memory of 3860	4336	wscript.exe	92
PID 3860 wrote to memory of 2392	3860	powershell.exe	94
PID 2392 wrote to memory of 3688	2392	csc.exe	95
PID 3860 wrote to memory of 360	3860	powershell.exe	96
PID 3860 wrote to memory of 360	3860	powershell.exe	96
PID 3860 wrote to memory of 360	3860	powershell.exe	96
PID 3860 wrote to memory of 360	3860	powershell.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO NO.4500101696.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\81ics6sm\cfg_28073_9bd0.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\81ics6sm\net_44121_9bae.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qmvxx34x\qmvxx34x.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2392
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES40E7.tmp" "c:\Users\Admin\AppData\Local\Temp\qmvxx34x\CSC7875D01A9C374F96BD31C2407AEB6D26.TMP"
        5⤵
        
        PID:3688
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
      4⤵
      PID:360

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cfg_28073_9bd0.vbs

Path C:\Users\Admin\AppData\Local\Temp\81ics6sm\cfg_28073_9bd0.vbs
Size 228B
SHA256 17af7016c65680002c5901da3b740e9ad8ae04389b1f93224efaca3da9d136a3
MD5 1cba885686a741ea5ad3e4cb9528713f
SHA1 01151a78297da758984d9389c95737dbb1fe4110
SHA512 50b6f4475415771b805d9f2fa9f479644628e264853f76d10cc179947c35ec483b55f573c643ab9319442ad42cef041490b0c422c51ad88ff9ee1788654b8704
TLSH
T1EFD0A710B139E21CCD25C86900A6862C8AF758586600577167909A18B99517DCE5D149
MD5 SHA1 SHA512 TLSH

Submit Download

cfg_89012_9bab

Path C:\Users\Admin\AppData\Local\Temp\81ics6sm\cfg_89012_9bab
Size 39KB
SHA256 0c6017316068472549e5ba09aaa8b4583462010923a8b13a19a19a7f14fef7cb
MD5 48cb2e194f8cdf874daa26012dd6f88b
SHA1 b599718c367efede638b6841f49d7e22cd8050dd
SHA512 a033e1c87032a7bb183cdd0a273fe156b11d6ef66ed58befaacd78cbdb253b1bcc256319662518f0ec93cd2c2dda762f52cd23f1b338111a2ec322271875b306
SSDEEP 768:u1dTvC4/ZVByexj6I3OyDVuavc+XdfIv8WUfHTS1A7V6znuryL:Q0cZV55O7QmUfHmO7V6T8e
TLSH
T1D203F18548D5F01BD8227D65076CFF3D8CE968B830D2C2D25DA8981FF22C74946BF698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_44121_9bae.ps1

Path C:\Users\Admin\AppData\Local\Temp\81ics6sm\net_44121_9bae.ps1
Size 5KB
SHA256 426d93cc0cdf3623048466d45446b083b12c3b088474ce6e2050f03f36466ebd
MD5 2dd248d6b95adda2c4962e1b467d0841
SHA1 4834dc281a4daf52549e6abae9e6ae6788c8c842
SHA512 3681d255285b4cc060602caf956f4cb44223135af42f134b4a1ba25bdeeb6f9a4cf25114ca3c1d28e720bd45a29fb3752ca17c1e3996717bc9e1d2bf8f13acc3
SSDEEP 96:aJcQulO9GG3z5Xayg9GUij/f5I9HK3tdqf5IJ3i4a6GIoBY67tKhwwDMJWtUvrce:gmOEG39XaygEUij/fsHy6fwiRvIomItz
TLSH
T129C174467AD98BFA02C3747459B65502B67CC43B324F0C04F6EDC6C9AF06478E7E91AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_47726_9bac

Path C:\Users\Admin\AppData\Local\Temp\81ics6sm\svc_47726_9bac
Size 329KB
SHA256 e20d9c1aa8f0b0b265983bf7e99d69bd6eb52b8f26738f715412deb91f238815
MD5 484f05ba768f8e6cd28519581449aa4c
SHA1 e9e8f686a3c88d41fa227800125dfd7ce68e4b81
SHA512 7ea4175d452d9b43bb4e147cedd3709c22683f9f9802e29ad22a66f40db647124af4e56d63843b44ca1247756fcf133133f34b413073be22cb3410fe8abeaa01
SSDEEP 6144:sFHXdpnJO9gG09AuN9LTqIZB76aPTUjXyVTsEkIr3O9BMP2fBUrmBdPhyIod:oHJWgGqPTqIZp6STUW13O3BBUSBdPhyd
TLSH
T1596423668BA1C73B67FC637609AF4FCC748CCD0485E73979A2DB315A4885B39B01B418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES40E7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES40E7.tmp
Size 1KB
SHA256 b19bb5dafc286a5d348bd558dff133c49e0735ba5b22e533d906bd6e9891f163
MD5 c0eb047d63ba04e2c592db8cf0892daf
SHA1 1a50fc1ae8a825adfc8649142ecd16c6b7c56688
SHA512 b170ece46b0c28b53e8770cf00c1d33e064396ef8f5ac4cbfb8732fe64d0f6f567d46c728f63ccf5cb2117a406b80534e8bd8038234fb67c1269034727b7ecce
TLSH
T10121AA0567EA870FF073473169FA572F9274FD55AFA1A75A454002282852504EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

qmvxx34x.dll

Path C:\Users\Admin\AppData\Local\Temp\qmvxx34x\qmvxx34x.dll
Size 3KB
SHA256 964008e101368a66523a3156adf2c8598c52a292be2b7f72c78a21f161a0d258
MD5 4c7f462252b90bcc9661ccabf9a75208
SHA1 4e554baab66648d59b123e6d559a91ac881cee36
SHA512 1773f96c2341de6480eca9d64efdf54752a6424ba0f3f8eb3697998ac9a2860ad1cb669e57e9de5378266a21e9d3c966b73e5957bb6b64723a0d84494639c6c3
TLSH
T1EC51DB1B6BE9862BF4730B31AEF3471777A4F8509BB2675E4D900268BC616548E31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7875D01A9C374F96BD31C2407AEB6D26.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qmvxx34x\CSC7875D01A9C374F96BD31C2407AEB6D26.TMP
Size 652B
SHA256 b8e2c5abb746bd7b6605412177c94c77f9d7a50f3bada310970cc205d8108bcc
MD5 1bbe749788707f782920603c47de6272
SHA1 fd45f37040ed647a85ca33ef94ae6c74cb58a82e
SHA512 f498470e009f1f1e4f57fe4e20ca2df6d932ff4792145b3070fc0bb1a7037166886b44c1aef08402c2445b4adbbd14052ba01f82fdc0e3e894b6bd4885f3e242
TLSH
T141F05E096BF9420EF0F34B30BDF64363E5A9BCA5DF3293ED1840031928655108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

qmvxx34x.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qmvxx34x\qmvxx34x.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

qmvxx34x.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qmvxx34x\qmvxx34x.cmdline
Size 369B
SHA256 fa17db231696dc0954a0fc863931cb0653a14067c9462af8dc78039c75a37344
MD5 928889c5107114e5c1bd57acf396a16d
SHA1 cfbfda50806a1cf722895c5b93bce5f371f315ea
SHA512 f76b1c269b934724ae0460afd8ef2b35bd5b3bf619cd3b21623a6db3a6843acd0492ea3d6dbd4adab12f21e63aca7158dafa3b5406076e2dbeb4d49d244dbe05
TLSH
T1C4E0C02B4246E27D17DE2207226BCCBCC27287432DC13F845240443DF05B50067F1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/360-27-0x0000000000400000-0x000000000048E000-memory.dmp

Download

memory/3860-12-0x0000028F4F4E0000-0x0000028F4F4F6000-memory.dmp

Download

memory/3860-8-0x0000028F4F440000-0x0000028F4F462000-memory.dmp

Download

memory/3860-25-0x0000028F4F4F0000-0x0000028F4F4F8000-memory.dmp

Download

memory/3860-26-0x0000028F4F500000-0x0000028F4F508000-memory.dmp

Download