Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 06:03
General
- Target Hilton Заказ_ 006854101 10092026 docx.js
- Size 998KB
- Sample260910-gr6hdahj6s
- SHA256 bf5abb5d8ed08b97a2712083d4bde0453fcc5d6d79de9664ee028f0741c5cb7e
Malware Config
Extracted
-
lxbaserat
-
1.0.41
-
SEPT-10-2026
-
62269c1cd1394d6fac0a26b7fcc0b0ef
-
lxrrxl.ydns.eu:4521
-
directory
WindowsTelemetry\Logs
-
executable
client.exe
-
password
9EYUE0qE8YGi90EBkLef
Signatures
- Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Hilton Заказ_ 006854101 10092026 docx.js"1⤵
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sajtpasq\clr_73250_e535.cmd1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\sajtpasq\svc_22381_e520.dat" "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -w h -Command -2⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
clr_73250_e535.cmd
dat_13628_e520
run_101558_e520
svc_22381_e520.dat
memory/1336-29-0x0000000000400000-0x0000000000496000-memory.dmp
memory/5056-13-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp
memory/5056-21-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp
memory/5056-14-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp
memory/5056-15-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp
memory/5056-16-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp
memory/5056-17-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp
memory/5056-18-0x00000292FAC50000-0x00000292FAC98000-memory.dmp
memory/5056-11-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp
memory/5056-20-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp
memory/5056-12-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp
memory/5056-22-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp
memory/5056-23-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp
memory/5056-24-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp
memory/5056-25-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp
memory/5056-10-0x00000292FA820000-0x00000292FA842000-memory.dmp
memory/5056-27-0x00000292FA8B0000-0x00000292FA8CA000-memory.dmp
memory/5056-28-0x00000292FA7D0000-0x00000292FA7D8000-memory.dmp
memory/5056-6-0x00007FFC121FF000-0x00007FFC12200000-memory.dmp
memory/5056-31-0x00007FFC12070000-0x00007FFC12A14000-memory.dmp