lxbaserat | 16669ce6b34d6479a044ae0826cc2c148e3fd607b81a5bbca374f6d44171cadf

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 11:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ТОО «Saruzhan KZ»_Order_1800936130826.xlsx.js
Size 852KB
Sample260813-nktcssyalc
SHA256 16669ce6b34d6479a044ae0826cc2c148e3fd607b81a5bbca374f6d44171cadf
MD5 d1b07c59861658cb59af4931c21833f3
SHA1 636c855a6a82e2a0c8dc0884d7f7da25ac8ba7e0
SHA512 51cc964dfb6e62d0ae17e0d77ef3ac96aeada91ffc53ad171ce1a2d5c8d2880ed79d84a3913e8ec0c87b4429de28b937f40304157f288af278bc91494a311ebb
SSDEEP 24576:wjKKmt1qsNqZ3TOvggo3uagsUTUXUcz5F8JEmILbHRAzuUsx8:smve36vggMua9TXUcz5mJKLbxAvsx8
TLSH
T1D805AEC6D167A0FD9388673E0D583C1D86EB418312B050C8CBAED99EAD8767D5FF6920
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aug-13-2026 063151d3625b40a982862ea98db34b8b execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.29

Botnet

AUG-13-2026

Campaign

063151d3625b40a982862ea98db34b8b

lxrrxl.ydns.eu:4521

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
WuBCWWc25432OEB5f2w9

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5524	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4396	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5524 set thread context of 4392	5524	powershell.exe	97

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5524	powershell.exe
5524	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5524	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 4396	3428	wscript.exe	92
PID 4396 wrote to memory of 5524	4396	wscript.exe	93
PID 5524 wrote to memory of 688	5524	powershell.exe	95
PID 688 wrote to memory of 3284	688	csc.exe	96
PID 5524 wrote to memory of 4392	5524	powershell.exe	97
PID 5524 wrote to memory of 4392	5524	powershell.exe	97
PID 5524 wrote to memory of 4392	5524	powershell.exe	97
PID 5524 wrote to memory of 4392	5524	powershell.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\ТОО «Saruzhan KZ»_Order_1800936130826.xlsx.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\ss9zui71\net_64512_7d8c.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ss9zui71\run_61521_7d42.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5524
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lar1n30c\lar1n30c.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:688
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD96E.tmp" "c:\Users\Admin\AppData\Local\Temp\lar1n30c\CSC2C8E00CE69DA4FE3A92B4F94F40C1D.TMP"
        5⤵
        
        PID:3284
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
      4⤵
      PID:4392

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESD96E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD96E.tmp
Size 1KB
SHA256 5f8f47889b308e0b06e6983fd6566b8630154ed873cf468e45113d3129765fcf
MD5 4e825a3c7968cc63e95c99a2266f0acd
SHA1 d53bc0173c19ceafe1c5736f6564559f56f4f0a7
SHA512 2db8b23b3379d2ae5846ff080f78a1653e20de3a4c4b2ddd91808f3bae9c1007797b10722ec06771dc83ed5d989e0d3b3a2463a70d58f1b3d93b25199bf54aa0
TLSH
T1CA218C0693F9471FF07347326AFA472B9674FD58DFA2975A498002282C51514EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

lar1n30c.dll

Path C:\Users\Admin\AppData\Local\Temp\lar1n30c\lar1n30c.dll
Size 3KB
SHA256 ac357f631cecdd2ae8c60aaf6db313d583dcc2a25452a4545046f3572ab3ad52
MD5 e22b539a0f9e84cd3e8fed2402677ce2
SHA1 dd465166023eaee5b273978e7772a547689fb29c
SHA512 322071301d92ea0a5c5fc51a92b3ee86f040fdf4b304a10db54ee135b0c230d7546140dd8454fd74d6a98313229a00ccf9e1bd22a5b3681ce8ab2c240f2f3c3b
TLSH
T1C751A91A57E88A2BF4730B31AEF3471777A4FC109BB3A75E0D904219AC606644E21BB0
MD5 SHA1 SHA512 TLSH

Submit Download

net_64512_7d8c.vbs

Path C:\Users\Admin\AppData\Local\Temp\ss9zui71\net_64512_7d8c.vbs
Size 228B
SHA256 cb69fc475272e3f5aed03acc48d95e4e89d50862a81a25ef6c5d43834838a23c
MD5 9c510ef3f5ea7ddd3c405bb7cf54fa70
SHA1 a8287aacaba01c412e7da6eec5cfcd067a7402ff
SHA512 dc84aa09b36b8ef9c0c5afc081041ba27cfc6fdb94ba25c9379657b1b5b663ca4d7f5532b613a372177547bdb1faa26e989f3df67e693bd1d0ea2b8ed7e7c8f3
TLSH
T141D02321B27FF60CCC24C9B501B2823CC2E3545D720057602760E904FD9217DCE6E20C
MD5 SHA1 SHA512 TLSH

Submit Download

run_61521_7d42.ps1

Path C:\Users\Admin\AppData\Local\Temp\ss9zui71\run_61521_7d42.ps1
Size 378KB
SHA256 9a4ceb5822bee65e6096597adec65e81833413173ae28776e8202aff1d200dfe
MD5 ccefb66ed6057692be94dd83a270bed7
SHA1 412956cc7d73b097233affe5d8ba7f8dd28138d2
SHA512 a10c8748a8a5ca8c08283c6642c6665f328510cacd556431ba98db34cb5014847f07fcbe721f3954756f5c5f6df288e37eb3bf490ece791b395cf4b2efbedfca
SSDEEP 6144:AITrM+p+ASw3IqhHHpP5CyQCOQ8v/VSfoQvBMviEjHyse393qIiL/+D/i4:jfM+p+EIsH7xd78AfBvBMvieH039a9/m
TLSH
T1618423A7873C856F4EF12971B6AD2D4D360EAA4171B8BA96B3EFD5C81F06C4042941FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC2C8E00CE69DA4FE3A92B4F94F40C1D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\lar1n30c\CSC2C8E00CE69DA4FE3A92B4F94F40C1D.TMP
Size 652B
SHA256 41416359cd70feb500f337a1924034c4e3669e468ee06f5a5d1fb0117f46b86a
MD5 cf2989a5ecef975ab979fd1ad0bf0a30
SHA1 42effaf174ede49ca8e4bed1803c65d9a1d3a6f9
SHA512 8d6a1a6bc12cfe5ceb66561eaeffcb6e22df6d6a647b1b9ba24b16ec24d252ffebbc9b1ea9c4c4ccadd0d70b21f92cf98ece9231a7cbc05b8362a6b794a926a7
TLSH
T163F05E0963F8020EF0F38B31BDF6436395A8BC65DE3293ED198003192C649208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

lar1n30c.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\lar1n30c\lar1n30c.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

lar1n30c.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lar1n30c\lar1n30c.cmdline
Size 369B
SHA256 0ee2625caeb48f60f9a56e7ecd64b472c54cb6a5bf7af3f7935fc93f1323da5f
MD5 3c9f3abd14168fc844e915b6809bdf83
SHA1 bf584d24852aa91df8388be58c8dda973668068c
SHA512 75547dd6e5dc65d5df0ed9aae5f13558d56bebfeafff96a9e8d3f19c8f60acd0e02cae9ea2ead8289d51c66422cb7b4aac631f2bf9b0591228ab6f2078ff8359
TLSH
T124E0C02B4366C77EC5DF14072169C4BCC273474329803F847843C44DD017000A7E6781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4392-23-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/5524-6-0x00000213E8930000-0x00000213E8952000-memory.dmp

Download

memory/5524-8-0x00000213E82F0000-0x00000213E8306000-memory.dmp

Download

memory/5524-21-0x00000213E8380000-0x00000213E8388000-memory.dmp

Download

memory/5524-22-0x00000213E83A0000-0x00000213E83A8000-memory.dmp

Download